Trusted Design

The HookAds Malvertising Campaign

概要

Not long ago we wrote about a new piece of malware called 'Trick Bot' which we caught in a malvertising attack via a high trafficked adult website. In the meantime, we uncovered another malvertising campaign that started at least in mid-August, and which leverages decoy adult portals to spread malware. Internally, we call it the HookAds campaign based on a string found within the delivery URL. What's interesting in this specific attack chain is the use of adult sites injected with new rogue ad domains that change quite frequently. However, upstream traffic to those adult sites also shows a pattern of malvertising via the usual suspects. In this post, we take a look at the distribution channel and the rogue infrastructure behind HookAds.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Large Malvertising Campaign Goes (Almost) Undetected (score: 0.73)
• WordPress Compromise Campaign (score: 0.69)
• China-based Ad Giant Serves Malicious Code Through Ad Slots (score: 0.64)
• A VAST Malvertising Attack (score: 0.64)
• Affiliate’s Malspam Operation: Kovter and Miuref/Boaxxe (score: 0.64)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る