#cloaking — Public Fediverse posts

#Cloaking and #geofencing let #phishing infrastructure selectively serve content based on visitor location, device, and network signals — meaning a scanner in a data center gets a 404 while a victim on a residential ISP gets the credential-harvesting page.

Modern DRP platforms need to replicate real victim conditions (residential egress, fingerprint randomization, OCR/computer vision) to see what attackers are actually hiding.

More here: https://www.netcraft.com/blog/detecting-cloaking-geofencing-evasion

We've written about Keitaro-based cloaking before, and the investment scam ecosystem abusing it remains as active as ever.

🚨 New campaigns continue to blend fake news/investment opportunity lures with global brand impersonation (SoftBank, Channel NewsAsia, CNN Brasil, etc.), paired with tightly controlled cloaking to target victims by region.

The campaign setup is all too familiar:

- Traffic cloaking with Keitaro: Operators use multiple Keitaro accounts to segment campaigns by geography and filter out non-targeted traffic
- Layered social engineering: Fake media narratives build credibility before directing users to investment or crypto registration forms
- Ad-driven distribution: Campaigns use Facebook and Twitter ads to drive victims to scam pages
- Reusable JavaScript kits: Pages deploy Russian-language scripts with fingerprinting and strict validation checks to vet victims
- TDS routing: TDS redircts funnel users who pass validation to fake or sketchy investment platforms or "advisor callback" pages

The consistency of this approach shows how effective and repeatable these techniques remain for driving victim engagement at scale.

Domain sample: justa-solvendaria-es[.]online, newstable[.]online, newsmini18[.]shop, news66[.]shop, news444[.]shop, news534[.]shop, smartrock24[.]shop, timeshe[.]shop

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #keitaro #investmentscam #tds #cloaking

We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

🔴 A threat isn't much of a threat if it can't reach the right victims. 📦 That's why many modern threat actors rely on cloakers and traffic distribution systems (TDS) to target, route, and hide at scale. In a six‑month joint effort analyzing four months of data with Confiant, we identified 15,500 domains configured to Keitaro instances and actively used in cyber campaigns. Keitaro is a legitimate ad tracker, but it is frequently misused by cybercriminals as an all‑in‑one tracker + TDS + cloaker in scam and malware campaigns. We encounter Keitaro in our investigations nearly every day, and we set out to quantify that abuse in the broader landscape. We're publishing a three‑part series to share what we learned. Part 1 focuses on a subset of actors who leverage AI in their operations, most of whom are tied to investment scams. At the end of the report, you'll find a link to our github repository that contains thousands of related Keitaro iocs.

https://www.infoblox.com/blog/threat-intelligence/inside-keitaro-abuse-a-persistent-stream-of-ai-driven-investment-scams/

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising

ICYMI: Meta sues scam advertisers in Brazil, China and Vietnam over celeb-bait and cloaking: Meta filed multiple lawsuits on February 26, 2026 against scam advertisers using celeb-bait and cloaking tactics in Brazil, China, and Vietnam, while issuing cease and desist letters to eight marketing consultants. https://ppc.land/meta-sues-scam-advertisers-in-brazil-china-and-vietnam-over-celeb-bait-and-cloaking/ #Meta #Advertising #ScamAlert #CelebBait #Cloaking

#Cloaking Activated

#cloak #me #selfie

Nowy wektor ataku łączący indirect prompt injection z cloakingiem wymierzony w autonomicznych agentów AI

Myślicie, że Internet może być niebezpieczny dla ludzi? No cóż, sztuczna inteligencja też już może zacząć się bać. Shaked Zychlinski z JFrog opisał nowy wektor ataku, który pozwala wstrzyknąć złośliwe instrukcje do asystentów AI przeglądających strony w Internecie. Dotychczasowe ataki typu indirect prompt injection polegały na ukryciu instrukcji na stronie...

#WBiegu #Ai #Awareness #Cloaking #Promptinjection

https://sekurak.pl/nowy-wektor-ataku-laczacy-indirect-prompt-injection-z-cloakingiem-wymierzony-w-autonomicznych-agentow-ai/

Web Browser AI Attacks Confirmed — What You Need To Know

Beware these AI-powered web browser attacks. getty Imagine if your web browser presented a harmless page to security…
#NewsBeep #News #Artificialintelligence #AI #ArtificialIntelligence #CA #Canada #cloaking #hack #hacking #HoaxTech #JSClickCloaker #phishing #SlashNext #Technology #webbrowserhack #webcloaking #websitehack
https://www.newsbeep.com/ca/8445/

Web Browser AI Attacks Confirmed — What You Need To Know

Beware these AI-powered web browser attacks. getty Imagine if your web browser presented a harmless page to security…
#NewsBeep #News #Artificialintelligence #AI #ArtificialIntelligence #cloaking #hack #hacking #HoaxTech #JSClickCloaker #phishing #SlashNext #Technology #UK #UnitedKingdom #webbrowserhack #webcloaking #websitehack
https://www.newsbeep.com/uk/8514/

AI Cloaking Tools Enable Harder-to-Detect Cyber-Attacks – Source: www.infosecurity-magazine.com https://ciso2ciso.com/ai-cloaking-tools-enable-harder-to-detect-cyber-attacks-source-www-infosecurity-magazine-com/ #rssfeedpostgeneratorecho #InfoSecurityMagazine #InfosecurityMagazine #CyberSecurityNews #Cloaking

Fast Flux is the New Cyber Weapon—And It’s Hard to Stop, Warns CISA https://thecyberexpress.com/cisa-nsa-fbi-issue-fast-flux-advisory/ #TheCyberExpressNews #TheCyberExpress #FirewallDaily #DoubleFlux #SingleFlux #CyberNews #cloaking #FastFlux #CISA #NCSC #FBI

We must know history to avoid repeating it.

We might need to use a #Cloaking strategy.

Remember when the Black Panthers got the N-R-A to draft g-u-n legislation?

#StrongerTogether
#History
#FightForEquality #FightForDiversity
#GeneralStrike

https://en.wikipedia.org/wiki/Mulford_Act

#Cloaking #Device
#TheTelegraph: '#Invisibility #cloak' that could hide tanks and troops looks closer to #reality.

#Wikipedia: ❛❛ Developments in #scientific research show that #realworld cloaking #devices can obscure #objects from at least one #wavelength of #EM #emissions. ❜❜

🔗 https://www.youtube.com/watch?v=pZMyWEWHCTM 2019 Oct 17
🔗 https://en.Wikipedia.org/wiki/Cloaking_device
🎓 h/t @Oliviero65

#Community #TimeTravel #Research #avoidance #invisibility #technology #HarryPotter #camouflage #Kronodon

Invisibility Cloak for Magnetic Obstacles
https://www.uni-bayreuth.de/en/press-release/invisibility-cloak-physics
#Research #Cloaking #MagneticField #UniBayreuth #UBT

Lumma Stealer is currently one of the most popular malware. Campaigns involving this info stealer have a notable presence in DNS. We’ve been tracking a threat actor that deploys large number of domains to advertise file share links dropping Lumma Stealer. These campaigns are interesting because the actor uses traffic distribution system (TDS), cloaking, and web tracking technology (e.g. Matomo, Bablosoft) to hide and protect the malicious content. Here are recent examples of the TDS and landing page domains.

:::TDS + Cloaking:::
am4[.]myidmcrack[.]site
bjnhuy[.]shop
filefetch[.]click
mplopop[.]shop
oyoclean[.]sbs
psldi3z[.]com
readyf1[.]click
volopi[.]cfd

:::Landing Page:::
14redirect[.]cfd
downf[.]lol
fbfgsnew[.]com
icjvueszx[.]com
lkjpoisjnil[.]site
sikoip[.]cfd
zulmie[.]cfd


An attack that we investigated today showed a new Lumma Stealer payload and C2 domain that is only a day old.

:::Lumma Stealer executable SHA256::: df148680db17e221e6c4e8aed89b4d3623f4a8ad86a3a4d43c64d6b1768c5406

:::Text sites containing Lumma Stealer configuration details:::
hXXps://rentry[.]co/feouewe5/raw
hXXps://pastebin[.]com/raw/uh1GCpxx

:::Newly created Lumma Stealer C2:::
hXXps://urbjanjungle[.]tech/api

#malware #lummastealer #c2 #tds #tracker #cloaking #dns #mastodon #threatintel #cybercrime #threatintelligence #cybersecurity #infosec #infoblox #infobloxthreatintel

#38C3: #Cloaking, Identitätsklau & Co. – die Technik hinter russischer #Desinfo | heise online https://www.heise.de/news/38C3-Cloaking-Identitaetsklau-Co-die-Technik-hinter-russischer-Desinfo-10222314.html #FakeNews #Desinformationen #Desinformation #Russia 🇷🇺 #Russland 🇷🇺

Nothing to see here!

On the awareness of and preparedness and defenses against cloaking malicious web content delivery.

Nice and insightful presentation by @wachizungu at @hack_lu

#cloaking #infosec #hacklu

🔗 Full thesis - https://research.ou.nl/ws/portalfiles/portal/43153260/Pinoy_J_IM990C_AF_CS_scriptie_PURE.pdf

Het is de dag van de digitale weerbaarheid. Vergroot je kennis over belangrijke begrippen zoals #phishing #typosquating #cybersquatting #cloaking #ceofraude #domeinnaamfraude & #factuurfraude via https://www.sidn.nl/thema/cybersecurity

What my theory presupposes is that while the Federation agreed by treaty to not develop cloaking technology, they can work around this by just temporarily changing a ship's registry to the NCC-404. I'll take my answer in the line for a corndog please. :hood: #StarTrek #Cloaking #Romulans #AlwaysAChessGame #FriendsOfDeSoto

#Development #Launches
IP Lookup · Find out if an IP address is a threat https://ilo.im/12v34x

_____
#Security #Attacks #Threats #Cloaking #Proxy #Bots #Malware #Business #WebDevelopment #WebDev #WebOperations #WebOps #SEO #WebAnalytics #Logfiles #Server #IpAddress

Today in BoneQuest History for May 5th 2011 "FANCY BOOK LEARNING" https://bonequest.com/4538 #bonequest :deuce: #cloaking #crysis #deuce_solo #dicks #stealth

"The Real #Enterprise Incident" (#StarTrek #TOS Reconstruction) #PartOne

"The real, internally #Classified "#EnterpriseIncident" had nothing to do with #Romulans, #Cloaking, or the #NeutralZone."

https://www.youtube.com/watch?v=P1zFn_FoTP4&ab_channel=deLimitedProductions

#Trek #FanProduction #FanMade #TimeTravel #USSEnterprise #Starbase #Part1

I veckans podd följer vi upp förrförra veckans Kalla fakta-inslag om bluffannonser för investeringsbedrägerier. Hur kan annonserna slinka igenom granskningen?

https://nikkasystems.com/2023/02/24/podd-186-cloaking-lurar-facebook/

#blisäker #podd #poddcast #poddradio #cloaking

"Cloaking" isn't new, but "perhaps" some better research and/or background checking would be good sometimes 🤔🙄

https://www.reuters.com/technology/exclusive-russian-software-disguised-american-finds-its-way-into-us-army-cdc-2022-11-14

#cybersec #CyberSecurity #dataprotection #privacy #privacymatters #Cloaking