Threat Intelligence Alert: Merry-Go-Round Conceals Ads from Users and Brands

May 31, 2024, 2:03 p.m.

Description

HUMAN's Satori Threat Intelligence and Research Team uncovered an ad cloaking operation, dubbed 'Merry-Go-Round', which involves two independent rings of websites that redirect traffic among each other in pop-under tabs, racking up digital ad impressions concealed from users. This sophisticated operation uses overlays to hijack mouse clicks, launch pop-unders, and cycle through domains, requesting numerous ads while hiding the fraudulent activity from brands and advertising partners through domain cloaking techniques.

Date

  • Created: May 31, 2024, 1:45 p.m.
  • Published: May 31, 2024, 1:45 p.m.
  • Modified: May 31, 2024, 2:03 p.m.

Indicators

  • travelmiso.co
  • thehealthfiles.com
  • thestorypick.com
  • stylelito.com
  • shoppinglifestyle.net
  • shoppinglifestyle.co
  • recipenomnom.com
  • parentingtoday.co
  • parentingcolumn.com
  • makeupsally.com
  • lovecolumnist.com
  • caloriemania.com
  • beautyparade.co

Attack Patterns

  • T1601
  • T1214
  • T1598
  • T1090