Adtech Abused by Threat Actors to Spread Malicious Advertisements

Malicious advertising campaigns have surged in sophistication, with cybercriminals exploiting and even operating adtech firms to deliver malware, credential stealers and phishing schemes directly through mainstream ad networks. A cluster of interconnected companies—run through shell corporations, hosted on compromised infrastructure, and registered en masse via a notorious registrar—has enabled a prolific threat actor, dubbed “Vane Viper,” to funnel malicious ads at global scale.

Vane Viper’s campaign begins at the corporate top: AdTech Holding, a Cyprus-based firm, controls subsidiaries including PropellerAds, ProPushMe, Zeydoo, Notix and Adex, which present themselves as legitimate networks but aggregate traffic from compromised sites and route clicks through a traffic distribution system to malicious landing pages.

Dynamic cloaking techniques include browser push notifications and service-worker scripts to achieve persistence, with Igor Limbakh appearing as a company director for PropellerAds and AdTech Holding. Observed push-notification domains include in-page-push[.]com and pushimg[.]com, and Vane Viper accounts for nearly half of all bulk registration events made through URL Solutions since January 2023, with domain registrations peaking at 3,500 per month in October 2024.

Enterprises face risk when legitimate networks deliver malware or credential-harvesting pages, and the piece calls for multi-layered defence and greater transparency across the adtech ecosystem.