Field Intelligence #5: Scareware at scale. Investment scams built on AI platforms.

The mobile scareware redirector we have tracked since March now has a name: ZoidWays.

Nov 11

October 2026

ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming

Confiant Threat Intelligence - security@confiant.com

Oct 15

14

4

September 2026

Opsec Fail Leaks a Rare Look Inside a Media-Buy-Powered Scam Operation

Inside the leaked Keitaro-powered backend of a cloaked investment scam targeting South Africa.

Sep 30 • Eliya Stein and Confiant

3

August 2026

Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning

One attacker wallet, 144 smart contracts, and 40+ compromised e-commerce checkouts quietly stealing shoppers' card data.

Aug 28 • Roshan and Confiant

4

1

July 2026

SourTrade: Browser-Assembled Malware Delivered Through Malvertising

How a persistent malvertising campaign impersonates trusted trading and cryptocurrency brands to assemble unique malware inside the browser.

Jul 23 • Michael Steele and Confiant

1

1

June 2026

Red Card: The 2026 FIFA World Cup Scam Landscape

Fake ticket portals, counterfeit merch, fake Panini storefronts, and deepfake gambling ads: a look into the malvertising-enabled campaigns active before…

Jun 11 • Roshan

Malvertising Campaign Spoofs GitHub to Deliver macOS Trojans

Evasive technique combines zero-width space (ZWSP) with Github spoofing to deliver malware through malvertising

Published on Roshan • Jun 2

April 2026

RBC 🇨🇦 Express AiTM Phishing Campaign

How AiTM malvertising bypasses MFA to drain Canadian business banking accounts, leaving victims in a months-long race to recover their stolen assets and…

Published on Roshan • Apr 24

March 2026

Tracking Software Weaponized by Criminals

Inside four months of joint research with Infoblox Threat Intel on the abuse of Keitaro Software.

Mar 24 • Confiant

2

1

Analyzing a Live AiTM Attack Targeting Google Accounts via Malvertising

We captured a malvertising campaign delivering an Adversary-in-the-Middle (AiTM) kit. Here, we unpack a paradox— an advanced payload undermined by…

Published on Roshan • Mar 24

February 2026

Disrupting 59M Malicious Impressions: Inside D-Shortiez Testing Infrastructure and Campaign Management

Two clusters, one password, and the automated harvesting that blocked campaigns before deployment

Feb 24 • Confiant and Michael Steele

3

4

The Curious Case Of MutantBedrog's Trusted-Types CSP Bypass

MutantBedrog is a malvertiser that caught our attention early summer ’24 for their highly disruptive forced redirect campaigns and the unique JavaScript…

Feb 3 • Confiant and Eliya Stein

3

1