Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows

Three financially motivated threat actors acquire expired malicious domains through dropcatch to inherit traffic from previously compromised websites. Stuffy Squirrel specializes in hiding activity within legitimate scripts and has operated since 2020, selling traffic to affiliate advertising networks. Shady Squirrel uses custom JavaScript and Keitaro injections with multi-step cloaking, partnering with initial access brokers to deliver tech support scams and SocGholish malware, notably facilitating SocGholish's return within weeks of Operation Endgame disruption. Swiping Squirrel, the most prolific actor, operates in greyhat territory by selling fraudulent traffic to zero-click advertising platforms like ZeroPark, often resulting in malvertising and malware distribution. These actors control thousands of domains collectively, exploiting lingering infections from previous compromises without conducting new attacks themselves.

• Placeholder Domains Whose Ads Serve ScamsCampaign2026-09-26
• Beyond the clipboard: The evolving tradecraft of ClickFixMalware2026-11-10
• Prediction Markets Emerge as a New Vertical for Traffer TeamsCampaign2026-10-29
• PHP · PHP2Shell (CVE-2026-109618/9) Havoc: UNC actors leveraging Public Exploit Code Against Public, Business And Educational InfrastructureExploitedVulnerability2026-10-27
• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16