This threat involves a traffic distribution system abusing search engine optimization and AI assistant exposure to deliver malicious PDFs containing fake CAPTCHA panels. These PDFs are hosted on Webflow's CDN and redirect users through a custom Elixir/Phoenix backend that filters traffic by IP, bot detection, and geography. The system directs qualifying users to three main endpoints: Legion Loader malware distribution, a traffic distribution system (TDS) reseller gate, and premium SMS subscription scams aimed at Spanish-speaking victims. Non-qualifying users are monetized via search-arbitrage advertising. The operation has been ongoing for over 14 months and uses over 12,700 structurally similar PDFs, indicating a large-scale, persistent campaign. The threat leverages multiple adversary techniques including search engine poisoning, traffic distribution, and social engineering via fake CAPTCHA challenges.

Victims are exposed to malware infections (Legion Loader), traffic distribution system reseller infrastructure, and premium SMS subscription scams, potentially leading to malware compromise, financial fraud, and unwanted premium charges. The campaign abuses legitimate CDN hosting and search engine results, increasing the likelihood of victim exposure. The targeting of English-speaking countries and Spanish-speaking users for specific scams indicates a broad and segmented impact. The operation monetizes non-qualifying traffic through advertising, indicating a financially motivated and scalable threat.

No official patch or fix is applicable as this is an abuse of legitimate services and search engine results rather than a software vulnerability. Mitigation should focus on user awareness to avoid interacting with suspicious CAPTCHA PDFs and domains listed as indicators. Security teams should block or monitor traffic to the identified malicious domains and hashes. Organizations should consider enhancing detection of traffic distribution system activity and premium SMS scams. Since the threat abuses Webflow's CDN, reporting abuse to the CDN provider may help disrupt hosting. There is no indication that vendor-side fixes or patches are available. Patch status is not applicable.