Confiant
Field Intelligence for the Ad Economy. Click to read Confiant, a Substack publication with hundreds of subscribers.
- Posts
- 65 from 9 Oct 2017 to 15 Oct 2026
- Posting
- monthly (12 in the last year)
- Kind
- company blog
- Feed
- https://blog.confiant.com/feed
2026 11
- ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming
- Opsec Fail Leaks a Rare Look Inside a Media-Buy-Powered Scam Operation
- Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning
- SourTrade: Browser-Assembled Malware Delivered Through Malvertising
- Red Card: The 2026 FIFA World Cup Scam Landscape
- Malvertising Campaign Spoofs GitHub to Deliver macOS Trojans
- RBC 🇨🇦 Express AiTM Phishing Campaign
- Tracking Software Weaponized by Criminals
- Analyzing a Live AiTM Attack Targeting Google Accounts via Malvertising
- Disrupting 59M Malicious Impressions: Inside D-Shortiez Testing Infrastructure and Campaign Management
- The Curious Case Of MutantBedrog's Trusted-Types CSP Bypass
2025 1
2023 5
- ScamClub's Deceptive Landing Pages
- Exploring ScamClub Payloads via Deobfuscation Using Abstract Syntax Trees
- BadTrip: A chain of fake travel sites abuses search ads to commit fraud and credential theft
- Malvertiser “D-Shortiez” abuses WebKit back button hijack in forced-redirect campaign
- Malvertiser Makes the Big Bucks on Black Friday
2022 5
- L’art de l’évasion: How Shlayer hides its configuration inside Apple proprietary DMG files
- CashRewindo: How to age domains for an investment scam like fine scotch
- How One "Crypto Drainer" Template Facilitates Tens Of Millions Of Dollars In Theft
- How SeaFlower 藏海花 installs backdoors in iOS/Android web3 wallets to steal your seed phrase
- A Whirlwind Tour Of Crypto Phishing
2021 9
- How File Hashes Fail As A Malware Detection Heuristic
- Profiling hackers using the Malvertising Attack Matrix by Confiant
- Malvertising Threat Actor “Yosec” Exploits Browser Bugs To Push Malware (CVE-2021–1765, CVE-2021–30533)
- Looking At Chrome Extensions That Hijack Search - Spread Via Malvertising
- OSX/Hydromac: A new macOS malware leaked from a Flashcards app
- Tag Barnakle One Year Later: 120+ More Revive Adserver Hacks
- Malvertiser “ScamClub” Bypasses Iframe Sandboxing With postMessage() Shenanigans [CVE-2021–1801]
- Malvertising: Made in China
- Persistent malvertising attacker DCCBoost raged as the year faded
2020 12
- The Trend Of Client-Side Fingerprinting In Cloaked Landing Pages
- Browlock Malvertisers Abuse Unaddressed Denial-Of-Service Bugs That Sit Dormant For Years
- Internet Explorer CVE-2019–1367 Exploitation — part 3
- Internet Explorer CVE-2019–1367 Exploitation — part 2
- Internet Explorer CVE-2019–1367 In the wild Exploitation — prelude
- Internet Explorer CVE-2019–1367 Exploitation — part 1
- Malvertising, Site Compromise, And A Status Report On Drive-by Downloads
- Confiant & Protected Media Uncover Mobile Billing Malvertiser Dubbed ‘wapSiphone’
- Tag Barnakle: The Malvertiser That Hacks Revive Ad Servers, Redirects Victims To Malware
- Exploring The Impact Of Malvertising On Government, ISPs & The Fortune 100
- Fake Celebrity-Endorsed Bitcoin Scam Abuses Ad Tech to Net $1M in 1 Day
- Trending Client-Side Innovations In Malvertising Payloads
2019 8
- New macOS Bundlore Loader Analysis
- Malvertiser 'eGobbler' Exploits Chrome & WebKit Bugs, Infects Over 1 Billion Ads
- OSX/Shlayer new Shurprise.. unveiling OSX/Tarmac
- Hong Kong Based Malvertiser Brokers Traffic To Fake Antivirus Scams — Over 100 Million Ads Compromised In 2019 So Far
- Massive eGobbler Malvertising Campaign Leverages Chrome Vulnerability To Target iOS Users
- Revealing How "The Dandelion Group" Leverages Multiple Layers Of Cloaking To Run Ad Fraud Campaigns
- Shlayer Purveyor VeryMal Renounces Steganography In Favor Of Google Firebase As Malvertisers Shift Towards Subtle Payloads
- Confiant & Malwarebytes Uncover Steganography Based Ad Payload That Drops Shlayer Trojan On Mac Users
2018 10
- CONFIANT’S DEMAND QUALITY REPORT FOR Q3 2018
- Nov 22–25 Attack of The Cyber Turkey
- Malvertising Attack Hijacks 300 Million Sessions Over 48 Hours
- JavaScript’s DOM Vanishing Act
- How Malvertisers Weaponize Device Fingerprinting
- CONFIANT’S INDUSTRY-FIRST AD QUALITY REPORT FOR Q2 2018
- The Malvertising Campaign Lifecycle
- Zirconium was one step ahead of Chrome’s redirect blocker with 0-day
- The Brief And Wondrous Life Of In-Ad Cryptojacking
- Uncovering 2017's Largest Malvertising Operation