Assessment: Latest campaign in a series that all abuse websocket functionality to forcefully redirect the page when a user is on a mobile device but serves an actual image if they determine the user is on a PC or otherwise should not be redirected. We have seen the campaign continue to acquire new domains to avoid detection and we are investigating additional related domains to prevent the spread of this threat.
Affected Platforms: Common path has been the Voluum DSP via Pubmatic.
Assessment: A redirect campaign from earlier this summer has resurfaced impacting about 500K impressions over the past few days.
Affected Platforms: Common path is via AdMixer & Bidswitch via a DSP called WayTop (waytopmobi).
Assessment: Over 200 domains have been traced to an individual in Ukraine who is using them to perform advertising/redirect campaigns that claim your devices is infected for the purpose of tricking users to install one of several mobile VPN applications. The application blocks internet connections under the pretense of the device being infected, the user is forced to pay in order to regain network access. The landing URLs are a series of VPN related domains (backupvpn.com, numberonevpn.com etc). ADL continues to investigate this threat and block new signatures as they arise.
Affected Platforms: My6sense DSP
Assessment: Redirect campaign driving users to domains such as walmart-u<dot>xyz and amazonpresent<dot>info, has been detected and blocked. Similar to earlier patterns, this campaign leverages malicious code hosted on Google CDNs.
Affected Platforms: For this particular campaign, the most common delivery path has been via Sovrn > Pubmatic > Bidswitch > Lazarus.Mobi (DSP).
Hijacked creatives
Assessment: Spike in malicious activity starting on September 7 and continuing through the weekend. Almost 6M impressions have been impacted. Ads are actively looking to disable blocking solutions and fraudulently driving users to domains like: october-gift-card[dot]cards.
Affected platforms: Rate of incidents was particularly high across Google ADX demand.
