Threat Spotlight: Angler Lurking in the Domain Shadows
Summary: Cisco Talos researchers documented an Angler Exploit Kit campaign that hijacks domain registrant accounts, typically through phishing, to silently create subdomains pointing at malicious servers - a technique they named Domain Shadowing. Talos found several hundred compromised accounts controlling thousands of domains and close to 10,000 unique subdomains, with more than 75% of that subdomain activity occurring since December 2014 and the earliest evidence dating to September 2011.
What's compelling: The compromised accounts are largely random and the subdomains are high-volume, short-lived and random - some active for only minutes - so blocklisting sites and IPs stops working, and researchers struggle to pull samples from landing pages that live under an hour. Talos notes the accounts share one registrar, GoDaddy, which it says holds almost a third of the domains on the Internet.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026