Ad-Driven Phishing and Malware Delivery

Source

---
analysis: A static rule for social media traffic is too noisy. This hunt uses a gated
  evaluation to contextually filter referrals and only alerts when rare binaries or
  suspicious form submissions occur on the same host.
blind_spots:
- id: no-tls-decryption
  question: whether the URL path or body for specific 'giveaway' lures was visible
  requires: TLS inspection at the gateway or browser-level logging
  risk: Encrypted network traffic prevents seeing the specific path or form data,
    leaving only the domain as evidence.
  stage: initial-access-fraudulent-ads
- id: telephony-blind-spot
  question: whether a user called a phone number listed in a scam ad
  requires: Telephony logs or external reporting
  risk: Phone-based social engineering is invisible to IT endpoint and network telemetry.
  stage: initial-access-fraudulent-ads
coverage:
- stage: initial-access-fraudulent-ads
  status: covered
  steps:
  - lead-ad-traffic
  - evaluate-lead
- stage: execution-fraudulent-software-install
  status: covered
  steps:
  - rare-browser-spawned-processes
- stage: credential-access-phishing-harvesting
  status: covered
  steps:
  - suspicious-form-submissions
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: Social media scam ads are a multi-billion dollar problem targeting
    user credentials and local systems; identifying the transition from social feeds
    to external execution provides a high-value signal for preventing financial and
    data loss.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary is using fraudulent social media advertisements to lure users
  into phishing sites or trick them into installing remote access tools, identified
  by browser-originating traffic from social platforms followed by rare process execution.
labels:
- hunt
- attack.t1566.002
- attack.t1190
- attack.t1204.002
- attack.t1566.003
- credential access
- execution
- initial access
name: Ad-Driven Phishing and Malware Delivery
parameters:
  browser_names:
    default:
    - chrome.exe
    - msedge.exe
    - firefox.exe
    - brave.exe
    - safari.exe
    description: Common browser executable names to monitor as parent processes.
    from:
      kind: manual
      observed: '2024-01-01'
      ref: hunt-standard
    type: list[string]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2024-01-01'
      ref: hunt-standard
    type: number
  scope_hosts:
    default: []
    description: Optional list of hosts to narrow the investigation; empty means the
      whole estate.
    from:
      kind: manual
      observed: '2024-01-01'
      ref: hunt-standard
    type: list[host]
  sensitive_paths:
    default:
    - /login
    - /signin
    - /auth
    - /verify
    - /bank
    - /checkout
    - /submit
    description: URL path segments often used in phishing or harvesting forms.
    from:
      kind: manual
      observed: '2024-01-01'
      ref: hunt-standard
    type: list[path]
  social_referrers:
    default:
    - l.facebook.com
    - t.co
    - linkedin.com
    - instagram.com
    - tiktok.com
    - fb.com
    description: Referrer domains for social media platforms used as ad delivery vehicles.
    from:
      kind: article
      observed: '2026-10-20'
      ref: eset-research
    type: list[domain]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.welivesecurity.com/en/social-media/is-ad-scam-how-tell-before-click/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Focus on endpoints where social media sites are accessed. Corporate proxies
  may mask the referrer, so prioritize hosts with local EDR agents providing unproxied
  process and HTTP events.
references:
- name: "ESET Research \u2014 Is the ad a scam? How to tell before you click"
  url: https://www.welivesecurity.com/en/social-media/is-ad-scam-how-tell-before-click/
related:
- hunt: browser-extension-malware-persistence
  reason: Scam ads can also trick users into installing malicious browser extensions,
    which requires hb_software_inventory inspection.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Initial Access via Scam Ads
    observables:
    - Ad impressions on social media platforms (Meta, Instagram, Facebook)
    - Sensational news headlines or clickbait used as lures
    - Deepfaked celebrity endorsements for investment scams
    - Traffic to domains mimicking legitimate brands or customer support
    - Browser exploitation attempts via malicious ad scripts
    slug: initial-access-fraudulent-ads
    tactic: initial-access
    techniques:
    - T1566
    - T1190
  - name: User Execution of Malicious Installers
    observables:
    - User prompted to download software to fix 'computer infection'
    - Execution of unknown or suspicious installers downloaded from browser
    - AppX deployment or MsiInstaller events from browser-initiated downloads
    - Installation of remote access software via social engineering pressure
    slug: execution-fraudulent-software-install
    tactic: execution
    techniques:
    - T1566
  - name: Credential and Financial Information Harvesting
    observables:
    - HTTP POST requests to fraudulent e-commerce sites or phishing pages
    - User input into web forms for 'prize giveaways' or questionnaires
    - Collection of card details, passwords, and personal identifiers (name, address,
      phone)
    - Call-back numbers on ads routing to fraudulent support centers
    slug: credential-access-phishing-harvesting
    tactic: credential-access
    techniques:
    - T1566
  summary: Adversaries leverage fraudulent social media advertisements and search
    results to redirect users to phishing sites or deliver malware. The campaign uses
    social engineering tactics like fake security alerts and celebrity endorsements
    to trick victims into downloading malicious installers or submitting sensitive
    financial credentials to spoofed e-commerce domains.
severity: medium
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# Ad-Driven Phishing and Malware Delivery

This hunt targets the complete lifecycle of a scam-ad intrusion. It begins by identifying users clicking through from social media platforms to external sites. The flow uses a gated design to first evaluate these leads before performing more resource-intensive queries for rare browser-spawned processes and credential harvesting activity. This allows the hunt to distinguish between legitimate social media browsing and the specific 'click-to-execution' pattern characteristic of malvertising and deepfaked celebrity investment scams.

## lead-ad-traffic
<!-- External traffic from social media referrers -->
Identify potential ad-click leads by finding HTTP requests where the referrer is a known social media domain and the target is an external site.

```sqlite target=web role=triage params=(lookback_days=lookback_days, social_referrers=social_referrers)
~~~yaml
expected: A list of hosts that followed a link from a social platform to an external
  domain. Silence suggests no such transitions occurred.
reads:
- device_hostname
- url_hostname
- url_path
- referrer
- user_agent
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-10-21'
~~~
SELECT device_hostname, url_hostname, url_path, referrer, user_agent, time FROM hb_http_activity WHERE (instr(',' || '{{social_referrers}}' || ',', ',' || LOWER(referrer) || ',') > 0) AND (instr(',' || '{{social_referrers}}' || ',', ',' || LOWER(url_hostname) || ',') = 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## evaluate-lead
<!-- Evaluate the referral lead -->
```agent target=hunter
cite: required
context:
- lead-ad-traffic
max_iterations: 3
objective: Review the external domains reached from social media. Flag those that
  appear to be typosquats, investment sites, or tech support lures.
success_criteria: A per-host verdict on whether the referral looks like a scam ad
  interaction.
tools:
- endpoint
- web
```

## gate-decision
<!-- Gate to fan-out -->
if~: "the evaluate-lead verdict identifies at least one suspicious host or destination" (confidence: high, judge=hunter)
then: → corroborate-activity
indeterminate: → close-out
unavailable: → close-out (blind_spot: no-tls-decryption)
else: → close-out

## corroborate-activity
<!-- Corroborate activity across endpoints and network -->
parallel:
- → rare-browser-spawned-processes
- → suspicious-form-submissions
join: → triage-full-chain

## rare-browser-spawned-processes
<!-- Rare browser-spawned processes -->
Search for installers or remote access tools spawned directly from browser processes, stacked by prevalence to find unique host activity.

```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, browser_names=browser_names, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Browsers spawning binaries that are not widespread across the fleet. Rare
  installers suggest user-initiated execution from a scam site.
prevalence:
  by: device_hostname
  key:
  - path
  rare_below: 3
reads:
- device_hostname
- process_path
- process_name
- process_cmd_line
- parent_process_name
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-10-21'
~~~
SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{browser_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND (instr(LOWER(process_name), 'setup') > 0 OR instr(LOWER(process_name), 'install') > 0 OR instr(LOWER(process_cmd_line), 'anydesk') > 0 OR instr(LOWER(process_cmd_line), 'teamviewer') > 0 OR instr(LOWER(process_cmd_line), 'rustdesk') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING hosts <= 3 ORDER BY hosts, runs
```

## suspicious-form-submissions
<!-- Suspicious web form submissions -->
Identify potential credential harvesting by finding POST requests to sensitive paths on the same hosts involved in ad clicks.

```sqlite target=web role=enrichment params=(lookback_days=lookback_days, sensitive_paths=sensitive_paths, scope_hosts=scope_hosts)
~~~yaml
expected: POST requests to login or verification paths on domains reached via social
  referrals. Silence means no harvesting submissions were recorded.
reads:
- device_hostname
- url_hostname
- url_path
- http_method
- request_body_len
- referrer
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-10-21'
~~~
SELECT device_hostname, url_hostname, url_path, http_method, request_body_len, referrer, time FROM hb_http_activity WHERE http_method = 'POST' AND (instr(',' || '{{sensitive_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## triage-full-chain
<!-- Weigh full intrusion evidence -->
```agent target=hunter
cite: required
context:
- evaluate-lead
- rare-browser-spawned-processes
- suspicious-form-submissions
max_iterations: 6
objective: Determine if any host showing suspicious ad referrals subsequently executed
  a rare binary or submitted data to a sensitive web path.
success_criteria: A verdict of malicious, suspicious, or benign per host, citing the
  chain of rows.
tools:
- endpoint
- web
```

## route-on-triage
<!-- Route on triage verdict -->
if~: "the triage-full-chain verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → analyst-review
unavailable: → analyst-review
else: → analyst-review

## isolate-host
<!-- Isolate compromised host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host immediately. Terminate the browser and any identified installer processes.
```
→ analyst-review

## analyst-review
<!-- Analyst review and reporting -->
```manual target=analyst
Review the cited browser activity and processes. If form submissions were detected, prompt the user for password changes and bank notification. Preserve the ad URL and domain for platform reporting.
```
→ close-out

## close-out
<!-- Close out -->
```manual target=analyst
Log the findings. Update the software inventory if any new unauthorized tools were found.
```
→ end