Threats Tagged 'bulletproof hosting'

A Chinese web-development framework called DCloud Uni-App has become the technical foundation for over 236,000 scam domains since 2022, powering fake cryptocurrency exchanges, pig-butchering operations, wallet drainers, gambling platforms, and brand-impersonation sites. The framework gained prominence after the 2024 RainbowEx cryptocurrency scam in Argentina, which defrauded residents of San Pedro. Similar operations include the Lightning Shared Scooter Co. (LSSC) scam in the United States, which caused millions in losses across multiple states, and the currently-active Yuechi Sharing Technology Ltd. bicycle-sharing investment scam. These operations use legitimate hosting providers, with approximately 6% utilizing bulletproof hosting, particularly CTG Server. The scams target victims globally through WhatsApp, Telegram, and social media, converting victims into recruiters for pyramid-style operations. Enterprise exposure reaches over 985 distinct organizations across 25 industry verticals, with over five m...

MediumCampaignUnited StatesArgentinaAustralia+2#dcloud#uni-app#lssc

DriveSurge is a newly identified threat actor operating as an Initial Access Broker that compromises thousands of websites to deliver malware through drive-by attacks. It uses malicious code injections that redirect visitors via a Traffic Distribution System (zTDS) to deploy malware through FakeUpdate prompts mimicking browser updates and ClickFix prompts that trick users into running malicious PowerShell commands. The actor employs sophisticated infrastructure including bulletproof hosting, obfuscated JavaScript, and targets multiple environments including macOS. This campaign has been active since at least September 2025 and is trackable by unique technical fingerprints.