{
  "name": "Threat Intelligence Alert: Merry-Go-Round Conceals Ads from Users and Brands",
  "slug": "threat-intelligence-alert-merry-go-round-conceals-ads-from-users-and-brands",
  "description": "HUMAN's Satori Threat Intelligence and Research Team uncovered an ad cloaking operation, dubbed 'Merry-Go-Round', which involves two independent rings of websites that redirect traffic among each other in pop-under tabs, racking up digital ad impressions concealed from users. This sophisticated operation uses overlays to hijack mouse clicks, launch pop-unders, and cycle through domains, requesting numerous ads while hiding the fraudulent activity from brands and advertising partners through domain cloaking techniques.",
  "published": "2024-05-31T11:45:17+00:00",
  "created_at": "2024-05-31T11:45:17+00:00",
  "modified_at": "2024-05-31T12:03:46+00:00",
  "created_at_opencti": "2024-05-31T11:45:17+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-05-31",
    "click hijacking"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "travelmiso.co"
      },
      {
        "id": "",
        "name": "thehealthfiles.com"
      },
      {
        "id": "",
        "name": "thestorypick.com"
      },
      {
        "id": "",
        "name": "stylelito.com"
      },
      {
        "id": "",
        "name": "shoppinglifestyle.net"
      },
      {
        "id": "",
        "name": "shoppinglifestyle.co"
      },
      {
        "id": "",
        "name": "recipenomnom.com"
      },
      {
        "id": "",
        "name": "parentingtoday.co"
      },
      {
        "id": "",
        "name": "parentingcolumn.com"
      },
      {
        "id": "",
        "name": "makeupsally.com"
      },
      {
        "id": "",
        "name": "lovecolumnist.com"
      },
      {
        "id": "",
        "name": "caloriemania.com"
      },
      {
        "id": "",
        "name": "beautyparade.co"
      }
    ],
    "attack_patterns": [
      {
        "id": "58873b53-09d8-4fa9-a9fc-fcc012065373",
        "name": "T1601"
      },
      {
        "id": "1f32188e-72c6-4d04-bbf2-3ec728b6f374",
        "name": "T1214"
      },
      {
        "id": "74d5f31c-5e2d-4aed-b8b9-4fabdde76dfa",
        "name": "T1598"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      }
    ]
  },
  "external_refs": [
    "https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-merry-go-round-conceals-ads-from-users-and-brands",
    "https://otx.alienvault.com/pulse/6659d46d8bb61a71449d13e3"
  ]
}