Field Intelligence #5: Scareware at scale. Investment scams built on AI platforms.

The mobile scareware redirector we have tracked since March now has a name: ZoidWays. It reached roughly 1.5 million blocked impressions in a single day and appeared across at least six buying platforms. This month’s briefing also covers a fake Microsoft Teams APK built to steal cryptocurrency; PseudoCamo, an investment-scam cluster using AI app-builder platforms; new D-Shortiez tech-support scam variants; and a Claude-branded investment scam that tricks victims into transferring their own funds.

Discover-Tech continues to draw scrutiny. Our technical analysis digs into the ad infrastructure behind zero-click spyware delivery and mass identity collection.

Five stories below.

ZoidWays: The Mobile Scareware Redirector Finally Has a Name

We have tracked this cluster since March and recently formalized a name for it. ZoidWays is a forced redirect campaign aimed at phones. Victims are presented with a clone of the phone’s settings screen, topped by a fake ‘Platform Security for wiretapping’ alert and a call to action to run a test. The test ends at an affiliate antivirus checkout, a paid support line, or a subscription trap. Landing domains rotate through names like safenetgroup[.]site and guardpointtech[.]online.

The same creative came through at least six DSPs in three weeks. Volume peaked near 1.5 million blocked impressions on September 12, with a CloudFront host fronting a domain we had first seen elsewhere three days earlier.

The Media Trust reported on this operation on August 2 under the name DarkRelay, and their CloudFront hosts and redirect broker match ours. They describe the navigation kit as twelve “sandbox escape” techniques plus a next-click hijack. Our understanding is different.

The twelve techniques are the usual list of popup and redirect attempts: top.location writes, window.open to _top, hidden anchors and forms targeting _top, a meta refresh on the parent, eval on the top window. All of them fail against a sandboxed cross-origin frame or get caught by the popup blocker, and the click listener works only in a same-origin context. We have not reproduced an escape from a properly sandboxed cross-origin frame on a current browser. When ZoidWays lands the redirect, it is because the frame is not sandboxed, the frame is same-origin, or there is no client-side coverage at all.

\(\begin{array}{ll} \hline \textbf{Cluster} & \text{ZoidWays (DarkRelay in The Media Trust's August report)} \\ \textbf{Payload} & \text{Forced redirect to fake ``Platform Security'' wiretapping alert, mobile only} \\ \textbf{Staging host} & \texttt{static.sunwaymarketing[.]co}\text{, fronted by rotating CloudFront distributions} \\ \textbf{Redirect broker} & \texttt{track.topofferlinks[.]com} \\ \textbf{Tracked since} & \text{Mid-March 2026, named September 2026} \\ \textbf{Peak volume} & \text{1.5 million blocked impressions} \\ \hline \end{array}\)

Fake Microsoft Teams APK Delivers a Full Crypto-Stealing RAT

A fake Microsoft Teams download page at teamsapk[.]cyou delivered a malicious APK. The APK is a full-featured remote access trojan built to steal cryptocurrency. It embeds the complete BIP-39 wordlist, the standard used to generate wallet seed phrases, and searches for those phrases in clipboard contents, accessibility service data, the filesystem, and photographs. The malware uses OCR to scan images on the device for seed phrases. A screenshot of a recovery phrase is enough to lead to catastrophic loss.

Fingerprint and face authentication are deliberately forced to fail, leading the device to fall back to a PIN or password, which the malware captures. SMS messages are intercepted as well. The full command set runs to 135 operations over a WebSocket connection to its C2 servers at abc.claude-go[.]com and abc.visapath-vp[.]com.

The operator’s internal status strings are in Chinese.

Ad CreativeLanding Page

\(\begin{array}{ll} \hline \textbf{Cluster} & \text{Unattributed (Chinese-language operator)} \\ \textbf{Landing domain} & \texttt{teamsapk[.]cyou} \\ \textbf{C2 servers} & \texttt{abc.claude-go[.]com}\text{, }\texttt{abc.visapath-vp[.]com} \\ \textbf{Primary objective} & \text{Cryptocurrency seed phrase theft (BIP-39, OCR from photos)} \\ \textbf{Capabilities} & \text{135 remote commands, biometric bypass, SMS interception, full surveillance} \\ \textbf{Impersonated brand} & \text{Microsoft Teams} \\ \textbf{First observed} & \text{Mid-August 2026} \\ \hline \end{array}\)

PseudoCamo Builds Investment Scams on AI App Builders

PseudoCamo is a cloaked investment-scam cluster we have tracked since April. We named it in late August, when it passed roughly 650 blocked domains. The cluster runs its campaigns on

AI app-builder platforms, such as lovable[.]app and base44[.]app. Domain-reputation systems that assess lovable[.]app as a single domain see a healthy developer platform.

The ad lands on an age-verification gate that asks the visitor to confirm they are eighteen, localized to the target country: “ani” for Romania, “lat” for Poland, “let” for Czechia, “años” for Spain, and in Canada a request to confirm legal age “in your province or territory” with no number at all. That initial landing page is a decoy “white” page. Behind it sits a redirect to a second-hop “money” page on a different .com or .pro domain, hosted with the redirect infrastructure. Examples observed during this period include: befideapro.lovable[.]app uncloaks to befidea[.]pro for Spain, and newsireland-2.base44[.]app and istanbul-space.base44[.]app as the cluster added Ireland and Turkey in late August.

Geographic spread has been broad: Poland first, Romania and Czechia by early August, Spain and Canada by mid-August, then Ireland and Turkey. The second-hop domains share a DGA shape, a cloaking kit, and creative style with BabaCamo, the Eastern European investment-scam cluster we have covered before.

befideapro.lovable[.]app, Targeting SpainWhite Page/ Age GateMoney Page (investment scam)

arveniop.lovable[.]app, Targeting South AfricaWhite Page/ Age GateMoney Page (investment scam)

\(\begin{array}{ll} \hline \textbf{Cluster} & \text{PseudoCamo (cloaked investment scam, sibling of BabaCamo)} \\ \textbf{White page host} & \texttt{lovable[.]app}\text{ and }\texttt{base44[.]app}\text{ pseudo-TLDs, some Render} \\ \textbf{White page} & \text{Localized age-verification gate} \\ \textbf{Money page} & \text{Second-hop .com / .pro domains, redirect infrastructure on Hostek AB} \\ \textbf{Geos} & \text{ZA, PL, RO, CZ, ES, CA, then IE and TR in late August} \\ \textbf{Scale} & \text{Roughly 650 domains blocked since April 2026} \\ \hline \end{array}\)

D-Shortiez Moves Its Tech-Support Scams to New Hosts and Adds a Fake CAPTCHA

D-Shortiez is a China-based forced-redirect actor we first identified in 2022, running gift-card-giveaway-style phishing attacks. Since pivoting to tech-support scams in 2025, they hosted their tech-support landing pages on Azure Blob static websites. The hostnames followed a pattern: message902fb81 plus six random characters, or viruswarning0824us plus a suffix, all under z13.web.core.windows[.]net.

Tech Support Scam Landing Page Evolution

In the second half of September, we picked up TSS landing pages abusing two different services: BunnyCDN [.b-cdn[.]net] and Microsoft Azure Cloud [.cloudapp.azure[.]com].

These new variants also add a fake CAPTCHA step before taking victims to the tech-support landing pages. While these might look like ClickFix attacks serving malware (infostealers), they are actually D-Shortiez forced redirects leading to tech-support scams. The example below uses a fake ChatGPT ad creative.

Sample domain: tp9265tnfqwdc4kmth34fe23[.]b-cdn[.]net

Stolen AdFake CaptchaTSS Landing Page

\(\begin{array}{ll} \hline \textbf{Cluster} & \text{D-Shortiez (forced redirect to tech-support scam, active since 2022)} \\ \textbf{Landing host} & \text{Azure Blob static websites, }\texttt{*.z13.web.core.windows[.]net} \\ & \text{BunnyCDN: }\texttt{tp9265tnfqwdc4kmth34fe23[.]b-cdn[.]net} \\ \textbf{Click tracker} & \text{.lat domains with native-ad click macros} \\ \textbf{New ad-domain TLDs} & \text{.space, .blog, .wiki} \\ \textbf{Delivery} & \text{Cross-origin and hosted-creative iframes at several DSPs, plus SSP direct} \\ \textbf{Peak campaign} & \text{Roughly 600,000 blocked impressions} \\ \hline \end{array}\)

Claude-Branded “Trading Bot” Tricks Victims Into Draining Their Own Wallets

We uncloaked an investment scam targeting the UK, revealing a ‘Claude’-branded money page served from lofim[.]shop through a black.php gate we have seen in other cloaking kits. The above Microsoft Teams APK used a Claude-themed C2 domain.

Here is how the scam works: Victims move their own money into a contract they deploy via their MetaMask wallet, believing it to be a legitimate trading bot. They make three voluntary transactions: deploy the contract, fund it with “liquidity,” click Start. That third transaction forwards the whole balance to the scammer.

Uncloaked landing page:

https://compile-code-online

[.]pages[.]dev/?gad_source=5&gad_campaignid=24237052761&gclid=EAIaIQobChMIivm43unolgMVOsUCBx12fDoAEAEYASAAEgLlPvD_Bw

Indicators

Public IOCs behind the stories above. Flag them in your demand paths.

ZoidWays:

• static.sunwaymarketing[.]co (payload stages)

• track.topofferlinks[.]com (redirect broker)

• safenetgroup[.]site (landing)

• guardpointtech[.]online (landing)

• dzoobhojw4l6s.cloudfront[.]net (fronting host, mid-September)

PseudoCamo

• befideapro.lovable[.]app

• arveniop.lovable[.]app

• newsireland-2.base44[.]app

• istanbul-space.base44[.]app

• befidea[.]pro

TeamsAPK

• teamsapk[.]cyou

• abc.claude-go[.]com

• abc.visapath-vp[.]com

D-Shortiez

• tp9265tnfqwdc4kmth34fe23[.]b-cdn[.]net

Investment Scam, Claude-branded lures

• lofim[.]shop

• compile-code-online[.]pages[.]dev

If you’re seeing something in your demand path that looks adjacent to any of the above, write to us. Full IOC lists and HAR captures are available on request, under NDA where appropriate.