Threat Intelligence Alert: Merry-Go-Round Conceals Ads from Users and Brands
May 31, 2024, 2:03 p.m.
Description
HUMAN's Satori Threat Intelligence and Research Team uncovered an ad cloaking operation, dubbed 'Merry-Go-Round', which involves two independent rings of websites that redirect traffic among each other in pop-under tabs, racking up digital ad impressions concealed from users. This sophisticated operation uses overlays to hijack mouse clicks, launch pop-unders, and cycle through domains, requesting numerous ads while hiding the fraudulent activity from brands and advertising partners through domain cloaking techniques.
Tags
Date
- Created: May 31, 2024, 1:45 p.m.
- Published: May 31, 2024, 1:45 p.m.
- Modified: May 31, 2024, 2:03 p.m.
Indicators
- travelmiso.co
- thehealthfiles.com
- thestorypick.com
- stylelito.com
- shoppinglifestyle.net
- shoppinglifestyle.co
- recipenomnom.com
- parentingtoday.co
- parentingcolumn.com
- makeupsally.com
- lovecolumnist.com
- caloriemania.com
- beautyparade.co
Attack Patterns
- T1601
- T1214
- T1598
- T1090