AI-themed investment scam network abused Keitaro cloaking across 15,500 domains
Researchers discovered a large investment scam network using more than 15,500 domains that abused the Keitaro Tracker platform to cloak scam content and deepfake videos of public figures from security detection systems. The operation targeted consumers with promises of high returns from AI-based trading platforms while hiding the scam from security tools through traffic filtering and cloaking techniques.
What happened
Researchers from Infoblox and Confiant discovered a large-scale AI-themed investment scam network operating across more than 15,500 domains. The campaign abused Keitaro Tracker, a commercial advertising platform, as a cloaking system to hide scam content from security tools.
Traffic to the scam pages was distributed through compromised websites, spam emails, social media posts, and online ads. The cloaking system showed legitimate users the investment scam landing page while showing security scanners and reviewers benign placeholder pages.
Reported impact
The scam sites promised high returns through 'Smart AI Trading Technology' or 'Intelligent Trading Solutions' and targeted ordinary users seeking investment opportunities. Some campaigns used deepfake videos and fabricated images of public figures or finance experts appearing to endorse the platforms.
Index analysis
Keitaro Tracker is a commercial platform originally designed for digital marketers to manage ad campaigns and route visitors to different landing pages. Threat actors abused its traffic filtering and routing capabilities to operate investment scams at scale, making the operation difficult to detect by filtering requests based on country, device, browser, referral source, and IP reputation.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.