A sophisticated threat actor named ‘CashRewindo’ has been using ‘aged’ domains in global malvertising campaigns that lead to investment scam sites.
Malvertising involves the injection of malicious JavaScript code in digital ads promoted by legitimate advertising networks, taking website visitors to pages that host phishing forms, drop malware, or operate scams.
The CashRewindo malvertising campaigns are spread across Europe, North and South America, Asia, and Africa, using customized language and currency to appear legitimate to the local audience.
Analysts at Confiant have been tracking ‘CashRewindo’ since 2018 and report the threat actor stands out for an unusually crafty approach in setting up malicious advertising operations with great attention to detail.
Domains get better with age
Domain aging is when threat actors register domains and wait years to use them, hoping to bypass security platforms.
This technique works as old domains that have not been involved in malicious activity for a long time earn trust on the Internet, making them unlikely to be flagged by security tools as suspicious.
Confiant says CashRewindo uses domains that have aged for at least two years before they are activated (have their certificates updated and a virtual server assigned).
The security firm was able to identify at least 487 domains used by the particular threat actor, some having been registered as far back as 2008 and used for the first time in 2022.
Victims end up on these landing sites by clicking on infected ads found on legitimate sites.
To evade “strong language” detection on legitimate sites, the threat actor flips between innocuous and call-to-action wording, usually starting the campaign carefully and switching to call-to-action ads later.
Mix of ads used by CashRewindo (Confiant)
The malicious ads also feature a tiny red circle that helps confuse computer vision detection modules so they cannot catch the fraud.
Global but highly targeted
Each CashRewindo campaign targets a particular audience, so the landing pages are configured to either show the scam or an innocuous or blank page for invalid targets.
Landing page with ‘click here’ button (Confiant)
This is done by checking the timezone, device platform, and language used on the visitor’s system.
Users and devices outside the target audience clicking the embedded “Click Here” button will be redirected to an innocuous site.
Valid targets, on the other hand, will execute JavaScript code with the malicious code hiding inside a common library to evade request inspection.
Malicious JS snippet running on valid targets (Confiant)
Those users are taken to a scam page and eventually redirected to a fake cryptocurrency investment platform promising unrealistic investment returns.
Fraudulent investment site (Confiant)
Confiant reports that over 12 months, it has recorded over 1.5 million CashRewindo impressions, primarily targeting Windows devices.
Targeted platforms (Confiant)
As for which countries bring most of these impressions, the top 20 most targeted locations are shown in the table below.
Top 20 most targeted countries (Confiant)
Investment scams are widespread, but usually, threat actors prefer quantity over quality, pushing their hastily crafted fake sites to large pools of users and hosting the scam platforms on recently registered domains doomed to go offline quickly.
CashRewindo follows a different approach that requires more work but significantly improves the chances of success for the threat actor.
Any investment opportunity that guarantees returns is most likely a scam, so treat this as a big red flag and run an extensive background check before depositing any funds.
News Related
-
-
-
Pope warns German church reform process elitist, ideological Pope Francis says there's a risk that a reform process in the German church could become “ideological.” VATICAN CITY — Pope Francis has warned there’s a risk that a reform process in the German Catholic Church over calls for married priests and ...
See Details:
Pope warns German church reform process elitist, ideological
-
-
-
-
-
-
-
-
-
A WOMAN has been labelled a “genius” after revealing the clever way she gets her laundry dry at home. Chloe took to TikTok to share the hack, explaining that it's all about the position of your airer. Chloe took to TikTok to show how she gets her laundry dry, by ...
See Details:
AstraZeneca’s Covid-19 drug loses US authorisation due to variants
-
-
A WOMAN has been labelled a “genius” after revealing the clever way she gets her laundry dry at home. Chloe took to TikTok to share the hack, explaining that it's all about the position of your airer. Chloe took to TikTok to show how she gets her laundry dry, by ...
See Details:
Kirsty Gallacher sets pulses racing in eye-popping pool dress
OTHER NEWS
Batting great Brian Lara has taken up a role as performance mentor with the West Indies which will see him working across all international teams and also having input into the academy.
Read more »
NYPD Commissioner Keechant Sewell this week soothed privacy advocates by saying that the department was not currently looking to expand its use of powerful facial recognition technologies. Yet while it ...
Read more »
DEAR DEIDRE: A SERIES of dating disasters has made me resolve to quit it altogether. The men I’ve met have left me feeling so horrible and down on myself that ...
Read more »
Oops! Something went wrong. Please try again later. Oops! Something went wrong. Please try again later. Oops! Something went wrong. Please try again later. Oops! Something went wrong. Please try ...
Read more »
MATT Hancock donated just three per cent of his I'm a Celebrity… Get Me Out of Here pay packet to charity. The former Health Secretary was paid £320,000 for his ...
Read more »
NADINE Dorries is hosting a new Friday night TalkTV show – and has landed Boris Johnson as her first guest. The former Secretary of State for Digital, Culture, Media and ...
Read more »
EMMERDALE's Gemma Oaten broke down in tears during an emotional appearance on BBC Breakfast. The 38-year-old actress and campaigner appeared on the show today to discuss eating disorders. Gemma was ...
Read more »
Elton John concert canceled due to wild New Zealand weather Torrential rain and wild weather in Auckland has caused disruptions throughout the city and an Elton John concert to be ...
Read more »
It’s fine that the Legislature approved an expansive new Equal Rights Amendment to the state Constitution, barring discrimination against anyone on the basis of race, ethnicity, national origin, disability, sex, ...
Read more »
A FORMER Ryanair air hostess has confessed she flashed a pilot mid-fight – but admitted that wasn’t the wildest thing she got up to. Before joining Babestation, Danni Levy used ...
Read more »
A TRANSGENDER double rapist was studying a beauty course with young female students while awaiting trial for the sex attacks, it has been revealed. Convicted predator Isla Bryson – guilty of ...
Read more »
IT’S the wacky app known for lip-syncing, dance moves and 15-second social media challenges. But with more than a billion videos viewed each day, TikTok is also an increasingly popular ...
Read more »
A FORMER Tk-Maxx worker has revealed the best days and times to shop in stores to bag absolute bargains. Dale O'Keeffe worked at the discount store for eight years, making ...
Read more »
ARCHAEOLOGISTS have made a huge “secret tomb” discovery in Egypt dating back 4,300 years. The major Ancient Egyptian find consisted of a gold-laced mummy and four tombs. The tomb discovery ...
Read more »
LOVE Island fans have spotted major rifts as the new bombshells arrived and turned the villa upside down. Spencer Wilks, 24, and Ellie Spence, 25, shocked the Islanders after they entered ...
Read more »
TOP Gear star Freddie Flintoff has put his TV career on hold after his horror car crash on the show. The dad of four, 45, was begged by his family ...
Read more »
AN elderly widower who was killed in a devastating house explosion made a fatal DIY error. Father-of-two Frank Burton, 91, was found dead following the “huge” blast in Wythenshawe, south ...
Read more »
BRITNEY Spears has clapped back at her fans, just two days after cops were called to her home. In an impassioned plea, the pop superstar begged fans and media to ...
Read more »
THESE are tough times. The days are cold and dark and people are working twice as hard to keep our schools, hospitals and many other essential services going. We all ...
Read more »
Louise Redknapp knows how to spin a look, and on Wednesday, the songstress served up a cool and casual ensemble to drop some exciting news with fans. The Eternal star, ...
Read more »
A DOG was spotted chewing through a front door in a Scots village – leaving passers-by baffled. Snaps of the pooch sticking its head through the door were shared on ...
Read more »
A MUM-OF-FOUR went in for a C-section for her first child, only to stump doctors when they cut her open to find her uterus empty. Tamara McPhedran shared her shocking ...
Read more »
A DATING expert has revealed her simple advice for singles to find the perfect partner. Natasha Graziano, 33, is a renowned mindset coach and motivational speaker who helps anyone looking for ...
Read more »
WE ARE into the back end of January and finally, the game everyone has been waiting for is about to take place. The two best clubs in English football right ...
Read more »
THE daughter of Sopranos star John Ventimiglia has died at the age of 25. Odele died on January 12 – just two months after she gave birth to a baby ...
Read more »
A GREYHOUND trainer was attacked in the stadium over a love triangle, it was claimed yesterday. James Turner was parading his dog when jilted Neil Gargow charged from the stands ...
Read more »
A MAN has been left baffled by a strange mail mix-up after ordering a £2,400 camera. Video producer Jakub Sokolowski ordered the top of the range camera for work but ...
Read more »
PORN star Ron Jeremy was already showing signs of dementia years before he was declared incompetent to stand trial on sex abuse charges, his pal Heidi Fleiss has revealed. Last ...
Read more »
BY any stretch, Shania Twain’s life has been one helluva ride. The horse-loving “Queen Of Country Pop” has a history of euphoric highs and devastating lows. Now, at 57, the ...
Read more »
BRITS needs to reconsider what time they put a wash on to avoid blackouts amid dwindling energy supplies, Martin Lewis has warned. The money saving expert urged households to avoid ...
Read more »
MICHELLE Keegan is the cream of the crop as she launches her new clothing range. The Brassic and former Corrie actress, 35, warmed to the task in a long knitted ...
Read more »
THIS is the shocking moment a teenage fisherman narrowly avoided being impaled by a marlin. The spear-billed sea beast leapt onto a boat in Sydney, Australia, while Cooper McGlashan, 16, ...
Read more »
A HUGE fire ripped through and destroyed an iconic church last night. The North London heritage-listed structure, described as an “architectural and historical treasure”, was engulfed in flames at 11.20pm. ...
Read more »
A FLIGHT expert has revealed why “windowless” seats exist on planes – and how to avoid missing out on a bird's eye view. Contrary to popular belief, not all passengers ...
Read more »
LOVE Island bombshell Spencer Wilks looks unrecognisable competing for Team GB before the show. Last night the 24-year-old entered the ITV2 villa alongside bombshell Ellie Spence, 25. Love Island bombshell ...
Read more »
TOTTENHAM are reluctant to sell Harry Kane this summer, but would reportedly rather he joined Bayern Munich than Manchester United. Spurs want to avoid selling Kane to a direct rival, ...
Read more »
THOUSANDS of Nectar customers can get up to £25 free just by doing their shopping next weekend. Shoppers signed up to the Nectar Points rewards scheme will be able to ...
Read more »
ABC/Netflix With its deep well of cast members, “Grey’s Anatomy” has a history of introducing characters that rise to become fan favorites. Such was the case of Dr. Lexie Grey ...
Read more »
Oops! Something went wrong. Please try again later. Oops! Something went wrong. Please try again later. Oops! Something went wrong. Please try again later. If you thought being a royal ...
Read more »
Mavericks star Luka Doncic exits win vs. Suns with ankle sprain Dallas superstar Luka Doncic exited in the first quarter of the Mavericks' 99-95 win over the host Phoenix Suns ...
Read more »