ThreatFox MISP Feed

Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

VexTrio, a cybercriminal organization, has been exposed for running a vast online fraud empire involving scams, spam, and malicious apps. Their operations include fake dating sites, cryptocurrency scams, and deceptive apps that have been downloaded millions of times. VexTrio uses sophisticated traffic distribution systems to deliver their scams, often infringing on well-known brands and celebrities. They also operate extensive spam networks, using lookalike domains of reputable email services. The group's activities extend beyond their core fraud business, with connections to seemingly legitimate enterprises in various industries. Despite operating for 15 years, VexTrio has managed to avoid legal consequences, highlighting the challenges in combating such large-scale online fraud operations.

The threat involves a cybercriminal organization known as VexTrio, which has been operating for approximately 15 years, orchestrating a large-scale online fraud empire. Their operations encompass a wide range of fraudulent activities including fake dating websites, cryptocurrency scams, spam campaigns, and malicious applications that have been downloaded millions of times. VexTrio employs sophisticated traffic distribution systems to funnel victims towards their scams, often leveraging the reputations of well-known brands and celebrities to increase credibility and victim trust. They also run extensive spam networks using lookalike domains mimicking reputable email services, which facilitates phishing and social engineering attacks. The group’s infrastructure includes numerous domains with various top-level domains (.com, .top, .life, .tech, .ch, .de, etc.), indicating a broad and distributed network. Their activities extend beyond direct fraud, with connections to seemingly legitimate enterprises, complicating detection and enforcement efforts. Despite their long-term operation and scale, VexTrio has largely evaded legal consequences, underscoring the challenges in dismantling such entrenched cybercrime operations. The campaign is categorized as medium severity, with no known exploits in the wild but significant indicators of compromise (IoCs) such as malicious domains. The threat leverages social engineering tactics (e.g., "Click to Allow" prompts) to trick users into granting permissions that facilitate fraud and malware delivery.

Detailed information about "Click to Allow" Robot Exposes Online Fraud Empire. Get real-time updates, technical details, and mitigation strategies.

"Click to Allow" Robot Exposes Online Fraud Empire - Live Threat Intelligence - Threat Radar | OffSeq.com

"Click to Allow" Robot Exposes Online Fraud Empire

Hazy Hawk, a sophisticated threat actor, exploits abandoned cloud resources of high-profile organizations through DNS hijacking. By identifying and taking over dangling CNAME records pointing to unused cloud services, they create malicious URLs on reputable domains. These URLs lead users to scams and malware via traffic distribution systems. Hazy Hawk employs layered defenses, including domain obfuscation and content theft from legitimate websites, to avoid detection. They also leverage push notifications to maintain persistent access to victims. The attacks have impacted government agencies, universities, and major corporations worldwide since at least December 2023. This campaign highlights the importance of proper DNS management and the growing sophistication of cybercriminals in the affiliate marketing space.

The threat campaign titled "Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor" involves a sophisticated adversary known as Hazy Hawk exploiting abandoned cloud resources via DNS hijacking. Specifically, the attacker identifies dangling CNAME DNS records that point to unused or decommissioned cloud services owned by high-profile organizations. By taking control of these orphaned DNS entries, Hazy Hawk can create malicious URLs under legitimate, reputable domains. These URLs are then used to redirect unsuspecting users to scam sites or malware distribution platforms through traffic distribution systems (TDS). The actor employs multiple evasion techniques including domain obfuscation and content theft from legitimate websites to blend malicious content seamlessly, thereby avoiding detection by security tools and users alike. Additionally, Hazy Hawk leverages push notifications to maintain persistent engagement and access to victims, increasing the likelihood of successful exploitation. The campaign has been active since at least December 2023 and has targeted government agencies, universities, and major corporations globally. The attack chain involves exploitation of cloud misconfigurations, DNS hijacking (T1583), exploitation of public-facing applications (T1190), use of traffic distribution systems (T1584), and social engineering tactics such as malicious push notifications (T1608) and user interaction (T1204, T1566). This campaign underscores the critical importance of diligent DNS record management and cloud resource lifecycle governance to prevent attackers from leveraging forgotten infrastructure for malicious purposes.

Detailed information about Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor. Get real-time updates, technical details, and mitigation s

Title	Severity	Type	Source	Date

Threats Tagged 'affiliate marketing'

Filter Threats

Threats Tagged 'affiliate marketing'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility