Vault Viper Exploits Online Gambling Websites Using Custom Browser to Install Malicious Program

Vault Viper has been found exploiting online gambling websites to install a malicious custom browser, the Universe Browser, which is distributed as a privacy-friendly tool but contains background programs enabling remote access and surveillance. The threat actor is linked to the Baoying Group and connected to the Suncity Group, with research attributing Vault Viper to a network of Asia-based crime organisations.

Investigations by Infoblox Threat Intel, in collaboration with the United Nations Office on Drugs and Crime Regional Office for Southeast Asia and Pacific, discovered the operation has potentially infected millions of devices worldwide. The Universe Browser serves as the primary distribution vector and hides keylogging functionality, unauthorized network connections, and covert device configuration changes consistent with remote access trojans.

Researchers describe a broader exploitation framework that includes DNS infrastructure and tens of thousands of associated domains used for ongoing command-and-control, extending the reach of these criminal networks. The report notes that online gambling platforms have become primary fronts for money laundering, cyber-enabled fraud, and other criminal activities, with Vault Viper functioning as a critical enabler of transnational organised crime in Southeast Asia.