Threat Intelligence Alert: Merry-Go-Round Conceals Ads from Users and Brands

May 31, 2024, 2:03 p.m.

Description

HUMAN's Satori Threat Intelligence and Research Team uncovered an ad cloaking operation, dubbed 'Merry-Go-Round', which involves two independent rings of websites that redirect traffic among each other in pop-under tabs, racking up digital ad impressions concealed from users. This sophisticated operation uses overlays to hijack mouse clicks, launch pop-unders, and cycle through domains, requesting numerous ads while hiding the fraudulent activity from brands and advertising partners through domain cloaking techniques.

Date

Published: May 31, 2024, 1:45 p.m.

Created: May 31, 2024, 1:45 p.m.

Modified: May 31, 2024, 2:03 p.m.

Indicators

travelmiso.co

thehealthfiles.com

thestorypick.com

stylelito.com

shoppinglifestyle.net

shoppinglifestyle.co

recipenomnom.com

parentingtoday.co

parentingcolumn.com

makeupsally.com

lovecolumnist.com

caloriemania.com

beautyparade.co

Attack Patterns

T1601

T1214

T1598

T1090