AI
How AdTech Became a Criminal Money Printer
Advertising is the financial backbone of the internet, and malicious ad networks run on exactly the same mechanics as legitimate ones. Both profile visitors by user agent, IP address, country, and prior visits. Both serve content based on those signals. The one tell: malicious networks identify researchers and redirect them to Google or Temu so the bad content never loads.
VexTrio has operated for 12 to 14 years. In 2024, 40% of compromised websites, mostly WordPress, redirected into the VexTrio traffic distribution system. InfoBlox sees it in more than half of its customers’ networks.
The YouTube Frame That Exposed VexTrio
For years, the team could not identify who ran VexTrio. A European investigative journalist found a YouTube video where a single frame showed a domain name already attributed to VexTrio, plus the ?u= and o= URL parameter pattern they had tracked for years. The group was recruiting affiliates in public, not on the dark web.
That video promoted Los Puyos Hermanos, a Breaking Bad-themed affiliate platform. Chasing its partner list led to Taco Loco (their push notification system). He walked through the passive DNS pivot to Lugano /24 (09:38), where shared mail server IPs across multiple domains pointed straight to AdsPro.
Mapping the Corporate Shell Game
VexTrio is the product of a merger. An Italian group traceable to 2004 through dating scams and spam lawsuits merged with an Eastern European group, primarily Russian and Belarusian, that had consolidated in Prague by 2015. Both moved to Lugano, Switzerland in 2020.
The combined enterprise spans roughly 100 companies tied to 8 to 10 key figures: ski resorts, energy companies, crypto platforms, payment processors. The Bulgarian CEO is visible on LinkedIn and race photos. The Russian and Belarusian founders hide better. InfoBlox linked them by matching the same luxury car in posts published days apart on separate accounts.
Blank Credit Cards and Fake Apps
Ad Trafficko, a VexTrio-owned company, ran blank CC offers: publishers dress up a $1.99 shipping page, collect up to $120 per credit card captured, and Ad Trafficko charges the victim $9.99 then drops them into a subscription. Burton published the details; the next morning the offers disappeared and a Russian blog scrubbed all mentions.
Their fake VPNs on Google Play and the Apple App Store are residential proxies, some flagged for capturing banking keywords. The spam-protection variant floods a phone with 150 daily notifications, then sells the fix at $6.99 per week to keep browser notifications off.
What the Investigation Proved About Malicious AdTech
InfoBlox has studied every commercial traffic distribution system it could find, and the result is consistent:
“Not one. And we’ve studied a lot.” — Renée Burton
Every system has Russian-speaking leadership. The profits are visible: private jets to Coldplay concerts, stratosphere flights from a Russian air base, professional racing teams, a ski resort. Burton’s three takeaways for the security community: malicious adtech deserves the same attention as malware; archive evidence independently because domain owners can erase Internet Archive copies; and scamming is a trillion-dollar business that industry disruption addresses faster than law enforcement.
Q&A
Do these guys ever serve legitimate ads and get click revenue, or is it always scams? Yes, through the apps they use cost-per-click advertising, sometimes routing to Total AV or Norton subscriptions via scareware; the majority of revenue comes from scams, not legitimate ad inventory. ▶ 35:26
Do you expect copies of this operation to exist globally, with thousands of people running similar businesses? Yes, InfoBlox has identified other major players whose traffic distribution software is technically identical to VexTrio’s but commercially unlinked, all operating behind large networks of shell companies. ▶ 36:41
What do these guys fear most, or what is the best avenue for disruption? Industry-level disruption through partners has been more effective than waiting for law enforcement; InfoBlox has been actively knocking down infrastructure with collaborators and is looking for more. ▶ 38:10
Notable Quotes
we know more about them than they do Renée Burton · ▶ 25:27
They take flights to the stratosphere. Renée Burton · ▶ 31:03
Not one. And we’ve studied a lot. Renée Burton · ▶ 32:40
Key Takeaways
- VexTrio reached the top 10,000 domains in 30 to 45 days and touched 40% of compromised WordPress sites in 2024.
- Every commercial traffic distribution system studied so far has Russian-speaking leadership, operating through hundreds of shell companies.
- Blank CC fraud pays affiliates up to $120 per stolen card; fake spam-protection apps extract $6.99 per week from victims.