Inside Keitaro Abuse Part 2: One Platform, Many Threats

This analysis examines how threat actors abuse Keitaro, an advertising performance tracker, for various malicious purposes. The report covers a wide range of threats, including malware delivery, phishing, scams, and illegal content distribution. Key findings include the use of Keitaro for cloaking and traffic distribution in malvertising campaigns, spam operations leveraging Keitaro for cryptocurrency wallet draining, and the abuse of Keitaro in investment scams. The report also highlights specific threat actors and their tactics, such as domain hijacking for adult content delivery and the use of fake arrests as clickbait for investment scams. Overall, the analysis demonstrates how Keitaro's features make it attractive to cybercriminals seeking to maximize their reach with minimal effort.

• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• Fake "View & Sign" and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect ClientsMalware2026-10-29
• PHP · PHP2Shell (CVE-2026-109618/9) Havoc: UNC actors leveraging Public Exploit Code Against Public, Business And Educational InfrastructureExploitedVulnerability2026-10-27
• How VBScript Malware Evades Detection Using Trusted Tools CopyMalware2026-10-27
• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27