Massive Adware Campaign Shuttered

guest · Jan 19, 2023

Mainly Apple iOS in-app ads were targeted, injecting malicious JavaScript code to rack up phony views.
January 19, 2023

A sprawling new adware campaign that abused the Vast video ad server template to rack up fraudulent digital advertising views on an enormous scale has been shut down.
Click to expand...

At its peak, the adware effort hit more than 12 billion requests per day.

Human Security's Satori threat intelligence team uncovered the adware campaign, touting it as the largest find in the cybersecurity research group's history. Following the discovery, Satori said it led a takedown of the ad fraud operation, which they dubbed as Vastflux.
Click to expand...

The team added in its report that, in all, Vastflux spoofed more than 1,700 apps, targeted 1,200 publishers, and displayed ads on applications running on about 11 million devices.

"What was technically impressive and incredibly concerning about Vastflux [were] the fraudsters hijacked impressions on legitimate apps, which makes it nearly impossible for users to tell if they are impacted," Gavin Reid, Human's CISO, said.
Click to expand...

Human Security: HUMAN Orchestrates Unprecedented Private Takedown, VASTFLUX

January 19, 2023
At its peak, VASTFLUX accounted for more than 12 billion fraudulent ad requests a day, impacting nearly 11 million devices
HUMAN Security, Inc., the global leader in safeguarding enterprises from digital attacks with modern defense, today announced the takedown of a highly sophisticated ad fraud operation where more than 1,700 apps were spoofed, targeting 120 publishers, running ads within apps on nearly 11 million devices, and reaching a peak volume of 12 billion ad requests a day. The attack injected malicious JavaScript code into digital ads, allowing the fraudsters to stack dozens of video ads on top of one another and registering views for ads completely invisible to the user.
Click to expand...

The Satori team found VASTFLUX while investigating an iOS app that was heavily impacted by an app spoofing attack. VASTFLUX is a very sophisticated scheme, exploiting the limited signal available to verification partners in the environment they targeted: in-app advertising, particularly on iOS.
Click to expand...

The takedown of the VASTFLUX operation comes just three months after the Satori Team announced the disruption of Scylla, a fraud operation targeting advertising software development kits (SDKs) within 9 apps on the Apple App Store and 80 Android apps on the Google Play Store, which collectively were downloaded more than 13 million times.
Click to expand...

Log in or Sign up

Massive Adware Campaign Shuttered

guest Guest

Log in or Sign up

Massive Adware Campaign Shuttered

guest Guest

Useful Searches