Confiant researchers noted a new campaign led by CashRewindo, where the threat actor is promoting investment scams through malvertising.
Making it sophisticated, the scammer here is using aged domains in his operation while also customizing the ads based on region and device language – to be more successful. This is a different approach compared to the current scammers in this field, who weigh quantity over quality.
Malvertising and Aged Domains
Tracking since 2018, the Confiant researchers have now detailed the campaign led by CashRewindo – a sophisticated threat actor malvertising investment scams hosted on aged domains to avoid suspicion.
Starting off, malvertising is the injection of any malicious JavaScript code in the digital ads promoted by legitimate advertising networks. If made attractive, these malicious ads can cater to clicks promoted through legit sites.
Well, CashRewindo is clever enough to customize them accordingly to attract more clicks. Based on the timezone, device platform, and language used on the visitor’s device, the malicious ads can tune themselves to be more understandable and attractive.
Even then, the threat actor is only aiming these ads at a specific audience to be more successful. So if the person clicking on the ad falls in their target audience, they will be redirected to a fake cryptocurrency exchange page – asking to register and attain unrealistic profits.
But if the clicked user is out of their targeted audience, they will be shown a blank page. Over the past 12 months, Confiant researchers have recorded over 1.5 million CashRewindo impressions, primarily targeting Windows devices.
Targeting users in Europe, Asia, and Africa, North and South America, there are around 480 domains identified in this scam, with some being registered in 2008 and used for the first time in 2022.
Other Trending News:- Â News
