HideClick

Reported Context (2)

was implemented via Keitaro flows, custom PHP filters, and thirdâparty cloaker integrations (e.g., HideClick, Adspect), allowing benign content for bots/reviewers while serving malicious payloads to targeted users. Infoblox and Confiant Detail Keitaro Abuse Patterns and Provider Response
However, we did observe them running Keitaro with the HideClick cloaking kit enabled in a prominent, high-volume campaign (hosted on investarmco[.]com) at the end of October 2025. Infoblox Details How Cybercriminals Abuse Keitaro to Scale Malicious Campaigns

Malware (6)

People (1)

Threat Actors (6)

MITRE ATT&CK (8)

Vendors (5)

Products (6)

Tools (5)

Industries (5)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.