TLDR Tech / InfoSec
Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure
Unit 42 traced two routine-looking adware infections to CL-CRI-1171, a pay-per-install operation that has run for two years behind a shared loader called OfferLoader, delivering payloads through 11 gaming-optimization YouTube channels and an SEO-poisoning funnel into corporate and government endpoints. The loader gates delivery on a Base64 click_id fingerprint of OS, browser, referrer, search keyword, and IP, so scanners and analysts get a decoy download page while real victims get the payload, which explains the near-zero public footprint despite 10,000+ loader samples and 200+ rotating domains. Defenders should stop triaging commodity loader alerts as low priority and pivot on loader C2 infrastructure instead, since a single OfferLoader run here spawned three unrelated campaigns including a cross-platform Insomnia RAT, a steganography-delivered WebSocket tunneler, and a Chrome Secure Preferences bypass.
Read the full story