Infoblox Tracks Three Actors Reusing Expired Malicious Domains
Summary
Infoblox details three “Squirrel” actors that acquire expired domains embedded in compromised sites and redirect inherited traffic to ads, scams or malware. It describes cloaking and injection chains, including Shady Squirrel’s reported traffic to SocGholish.
Key points
- Infoblox identified three actors—Stuffy Squirrel, Shady Squirrel and Swiping Squirrel—that repurpose expired domains still embedded in compromised websites to receive and monetize visitor traffic.
- Stuffy Squirrel uses separate server-side checks and a real-user-click requirement to hide popunder delivery from automated scanners; direct requests may instead receive a legitimate-looking script.
- Shady Squirrel filters traffic using referral information and other checks, and has routed visitors to gambling, tech-support scams and SocGholish. Infoblox observed a fake-update delivery it attributed to SocGholish in July 2026.
- The researchers describe a two-part Keitaro injection that passes a hard-coded window configuration to a server, whose response may redirect visitors or inject content. They say the mechanism’s ownership remains unclear.
- Swiping Squirrel fingerprints and cloaks visitors before selling traffic through affiliate platforms; Infoblox observed downstream destinations that included scams, malware and commerce pages.
- Infoblox reports that the actors control thousands of domains and can inherit traffic without compromising the affected websites themselves, although it also observed some direct script injections by Shady Squirrel.
Article Details
- Attack Vectors
- Actors acquire expired malicious domains still embedded in compromised websites and reuse them to redirect visitors to scams, malware, or advertising networks.
- Stuffy Squirrel injects JavaScript loaders into compromised pages; the scripts call actor-controlled domains and condition delivery on the request URL and user interaction.
- Shady Squirrel uses custom JavaScript injections, Keitaro calls, referral checks, and server-side fingerprinting to route selected visitors while showing the original page to bots or scanners.
- Some Shady Squirrel scripts were appended to legitimate WordPress theme files. The article says this may indicate direct WordPress exploitation or affiliates injecting the scripts, but does not confirm how access was obtained.
- Shady Squirrel redirected Windows users arriving from search engines to tech-support scam pages that displayed fake compromise warnings and urged victims to call support and install remote-access tools.
- Shady Squirrel routed visitors to SocGholish fake updates; Swiping Squirrel sold fingerprinted visitor traffic through advertising brokers, where users could encounter scams or malware.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ads-analytic[.]com | Keitaro server domain that returned JavaScript redirecting visitors to Help TDS. |
| DOMAIN | advanceslibrary[.]com | Shady Squirrel registered this domain, likely for SocGholish; injections calling it preceded a confirmed fake-update payload. |
| DOMAIN | blacksaltys[.]com | Domain acquired and used in Shady Squirrel's infrastructure; previously operated by TA2726. |
| DOMAIN | brodirect3s[.]site | Domain listed among those acquired by Shady Squirrel and used in its infrastructure. |
| DOMAIN | cdnjslibraries[.]com | Shady Squirrel dropcatch domain used both as a Keitaro domain and later for a custom injection. |
| DOMAIN | gsstats[.]ru | Stuffy Squirrel's reported primary entry-point domain since November 2025. |
| DOMAIN | imhd[.]io | Domain listed among those acquired by Shady Squirrel; it had previously been a legitimate CDN. |
| DOMAIN | magesource[.]su | Domain inherited and reused in Stuffy Squirrel's infrastructure; previously used for Magecart card skimming. |
| DOMAIN | pausewatchings[.]com | Domain reported sending Shady Squirrel traffic to the ProPush advertising service. |
| DOMAIN | pills-europe[.]com | Domain reported sending Shady Squirrel traffic to the ProPush advertising service. |
| DOMAIN | renpaste[.]top | Example phone-number server domain associated with the tech-support scam infrastructure. |
| DOMAIN | simplejscdn[.]com | Domain listed among those acquired by Shady Squirrel and used in its infrastructure. |
| DOMAIN | sport2news[.]com | Domain used in the described Keitaro/Help TDS redirect chain to load JavaScript and initiate the handoff. |
| DOMAIN | tofuturepubs[.]com | Former Stuffy Squirrel entry-point domain used during 2024 and 2025. |
| DOMAIN | weatherplllatform[.]com | Domain inherited and reused in Stuffy Squirrel's script infrastructure; previously served as Balada injector infrastructure. |
| DOMAIN | wesq[.]me | Domain listed among those acquired by Shady Squirrel and used in its infrastructure. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes obfuscated Keitaro injection scripts and server-side cloaking that conceal the delivery chain.T1036.005 · Match Legitimate Resource Name or LocationThe malicious Stuffy Squirrel script uses the same filename as the legitimate Raphaël.js decoy, making both files appear alike until the injected IIFE runs.T1059.007 · JavaScriptThe actors use injected and remotely loaded JavaScript for fingerprinting, redirection, and delivery-chain logic.T1189 · Drive-by CompromiseCompromised websites with lingering injected scripts redirect selected visitors into scam, advertising, and SocGholish fake-update chains.T1497.001 · System ChecksServer-side fingerprinting and bot checks determine whether to serve malicious content or the original page.T1497.002 · User Activity Based ChecksStuffy Squirrel's popunder windows open only after a real user click, hiding downstream delivery from automated scanners.T1583.001 · DomainsThe described actors acquire expired domains and register domains for use in their redirect and injection infrastructure.T1583.006 · Web ServicesThe tech-support scam operator created Azure static-web-hosting accounts to serve lure sites.
People
Threat Actors
MagecartA domain inherited by Stuffy Squirrel had previously been used for Magecart card skimming targeting compromised Magento stores.Shady SquirrelInfoblox tracks this actor as acquiring expired domains and using injections, Keitaro, and cloaking to route selected visitors to gambling, tech-support scams, and SocGholish fake updates.SocGholishThe article identifies the fake-update path delivered through Shady Squirrel as SocGholish and reports that Shady Squirrel began sending it traffic after Operation Endgame.Stuffy SquirrelInfoblox tracks this actor as operating a traffic distribution system that reuses expired malicious domains and redirects visitors to affiliate advertising, scams, or unwanted content.Swiping SquirrelInfoblox reports that this actor fingerprints visitors and sells their traffic through advertising brokers, where downstream destinations can include scams or malware.TA2726The article identifies TA2726 as a prior operator of domains later acquired or reused in the dropcatch ecosystem.
Malware
Vendors
ExoClickPhase I: PushHouse and ExoClickMicrosoftA series of pop-up windows filled the screen with warnings that the machine had been hacked, and that the user needed to dial Microsoft support at a specific phone number; see Figure 5.Propeller AdsIn this instance, Shady Squirrel kicked off three events and one is a redirection to Propeller Ads’ push monetization service, ProPush.PushHousePhase I: PushHouse and ExoClickTeam InternetAccording to our observations, Swiping Squirrel sells most of their traffic to Team Internet’s ZeroPark.
Products
AzureBefore that, the thief abused Microsoft Azure static webhosting to serve lures, creating nearly 10k accounts a month across at least nine regions globally.ExoClickPhase I: PushHouse and ExoClickMagentoThe domain magesource[.]su was previously used as a Magecart card-skimming domain targeting compromised Magento stores to steal payment card data.Microsoft WindowsThis is due to a third layer of evasion that sits beyond both server-side checks: the popunder windows only open on a real user click.ProPushIn this instance, Shady Squirrel kicked off three events and one is a redirection to Propeller Ads’ push monetization service, ProPush.PushHousePhase I: PushHouse and ExoClickWordPressThe domain weatherplllatform[.]com was previously used as Balada injector infrastructure, infecting thousands of WordPress sites during the campaign’s peak and was Sucuri’s second most-blocklisted resource in 2022.ZeroParkAccording to our observations, Swiping Squirrel sells most of their traffic to Team Internet’s ZeroPark.
Tools
Countries
Industries
advertisingOne actor sells to a large global media commerce platform, another sells to advertising networks most people won’t recognize, and the third sells traffic to big name cybercriminals like SocGholish.E-commerceOther verticals we’ve seen include e-commerce affiliate fraud and online gambling.online gamblingOther verticals we’ve seen include e-commerce affiliate fraud and online gambling.