How Money Laundering, Scams, and Espionage Hide in a Web Full of Casino Garbage

This threat involves illegal online gambling infrastructure that spans multiple cybercrime categories, including money laundering, scams, and espionage. It includes over 1.7 million Chinese-language casino domains linked to triad-aligned syndicates, thousands of scam gambling websites targeting global users with rigged games and withdrawal fraud, and China-aligned APT groups deploying the PeckBirdy malware framework via fake casino and adult websites. These operations exploit hosting providers in the U.S. and Europe while using bulletproof hosting in Asia. The campaigns have increased sharply since 2023, with PeckBirdy domains evading detection on VirusTotal. The visual similarity of these sites complicates detection efforts.

• Omegatech Is Disrupted, and the Pressure on Bulletproof Hosting Keeps BuildingCampaign2026-10-28
• Disposable Domains, Durable HostingMalware2026-09-23
• From San Pedro to Salinas: How a Chinese Framework “DCloud Uni-App” Powers a Global Scam EconomyCampaign2026-06-25
• A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised SitesCampaign2026-05-30
• “Say My Name”: How MioLab is building MacOS Stealer EmpireMalware2026-04-30