Post by Infoblox Threat Intel

ourselves.space

39d

A few weeks ago, @knitcode started running a "user experience" study of VexTrio -- the long running malicious traffic distribution system (TDS) / malvertiser / scammers / cybercriminals -- by visiting a VexTrio compromised website from a clean Pixel 2 phone and seeing what happened over time. The idea being that you really can't get the picture from sandboxes and scanners of the true user experience. These are posted on LinkedIn and we're going to replay them here. Hopefully folks find them useful.

We've learnt a lot about VexTrio over the last few months after tracking them for the last three years. Stay Tuned. :)

We start with a simple a/v scam. there are tons of these. They recommend you download the best spam app at clicktolead[.]info.

#dns #threatintel #cybercrime #scam #malvertising #infobloxthreatintel #infoblox #vextrio #cybersecurity #phishing #infosec

1 0 0 View Post & Replies See Original

39d

VexTrio User Experience 2/N ....

It starts by visiting a compromised website and performing a fake captcha. This allows them to push notifications. In one thread, you may accept pushes from both VexTrio and an affiliate. Now your phone is filled with a wide variety of scams and sketchy apps.

Below is
* The VexTrio fake captcha (there are several variants of this)
* A typical screen for me these days

Mostly scams. I did have one push notification "from God" with a message for me. Clicking on that took me to beliefnet[.]com and then to the LDS page. I suspect that belieftnet[.]com is just buying ad space from some network and somehow it ends up being delivered via VexTrio's own networks.

If you unsubscribe from notifications, in many cases, you instantly receive several notifications from another domain. I don't really understand how that works, because all of this is via Google or Firefox systems. But i've done it multiple times.

#dns #threatintel #cybercrime #scam #malvertising #infobloxthreatintel #infoblox #vextrio #cybersecurity #phishing #infosec

0 0 1 View Post & Replies See Original