Takedowns and Adventures in Deceptive Affiliate Marketing
Summary: Unit 42 analyzed multi-year affiliate marketing spam campaigns that used compromised servers and abused domains to push fake celebrity-endorsement pages for weight-loss and brain-enhancement pills, mapping thousands of compromised servers and hundreds of compromised accounts. Working with GoDaddy, the effort took down over 15,000 subdomains, and researchers tied 689 landing pages back to 21,611 potentially compromised websites using a Caesar cipher injection tagged "CaesarV".
Bottom line: The campaign ran for over two years and relied on 21,611 potentially compromised websites, meaning a single injected PHP file on your server can quietly redirect your visitors to scam pages without your knowledge.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026