# T1583.008 Malvertising

> As of 2026-10-05, T1583.008 (Malvertising) appears in 35 tracked threats, first reported 2026-02-06 and most recently 2026-10-04, with linked actors including Storm-2755, APT38, DriveSurge; it most often appears alongside T1583.001 (Domains).

- **Tracked threats:** 35 (3 critical, 29 high, 3 medium)
- **First seen:** 2026-02-06
- **Last seen:** 2026-10-04
- **Threat actors:** 13
- **Detection rules:** 52 (counts only; Blue tier and above)

## Key facts

- **ID:** T1583.008
- **Framework:** MITRE ATT&CK
- **Tactics:** Resource Development
- **Matrix:** Enterprise
- **Parent:** T1583
- **Data as of:** 2026-10-05
- **MITRE:** https://attack.mitre.org/techniques/T1583/008/

## Activity timeline

T1583.008 first appeared in tracked threats on 2026-02-06 and was most recently reported on 2026-10-04. The busiest month was 2026-08 with 11 reports, and 35 of the 35 threats were reported in the twelve months to 2026-10.

## How adversaries use it

T1583.008 Malvertising is catalogued by MITRE ATT&CK under the Resource Development tactic in the Enterprise matrix, as a sub-technique of [T1583 Acquire Infrastructure](https://intel.threadlinqs.com/technique/T1583). Threadlinqs maps 35 of 2623 tracked threats (1.3%) to it; by severity that is 3 critical, 29 high, 3 medium.

Threats that use T1583.008 most often also use [T1583.001 Domains](https://intel.threadlinqs.com/technique/T1583.001) (20 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (19 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (18 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (18 threats), [T1140 Deobfuscate/Decode Files or Information](https://intel.threadlinqs.com/technique/T1140) (16 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

13 tracked threat actors appear in the threats that use T1583.008; the most frequent are [Storm-2755](https://intel.threadlinqs.com/actor/Storm-2755) (2), [APT38](https://intel.threadlinqs.com/actor/APT38) (1), [DriveSurge](https://intel.threadlinqs.com/actor/DriveSurge) (1), [Ghost Stadium](https://intel.threadlinqs.com/actor/Ghost%20Stadium) (1), [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) (1).

## Mitigations

MITRE ATT&CK lists 1 mitigation for T1583.008.

- [M1056 Pre-compromise](https://attack.mitre.org/mitigations/M1056/)

## Data sources

Telemetry that can reveal T1583.008, per MITRE ATT&CK.

- Internet Scan — Response Content

## Threat actors using it

- [Storm-2755](https://intel.threadlinqs.com/actor/Storm-2755) — 2
- [APT38](https://intel.threadlinqs.com/actor/APT38) — 1
- [DriveSurge](https://intel.threadlinqs.com/actor/DriveSurge) — 1
- [Ghost Stadium](https://intel.threadlinqs.com/actor/Ghost%20Stadium) — 1
- [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) — 1
- [INC Ransom - G1032](https://intel.threadlinqs.com/actor/INC%20Ransom%20-%20G1032) — 1
- [Konni APT](https://intel.threadlinqs.com/actor/Konni%20APT) — 1
- [Lynx](https://intel.threadlinqs.com/actor/Lynx) — 1
- [Milk Dragon](https://intel.threadlinqs.com/actor/Milk%20Dragon) — 1
- [Sable Squirrel](https://intel.threadlinqs.com/actor/Sable%20Squirrel) — 1
- [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 1
- [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 1

## Tracked threats

The 30 most recent of 35 tracked threats that use T1583.008.

- [Milk Dragon (NaiLong) AiTM Phishing-as-a-Service Kit Uses Real-Time OTP Relay and WebSocket Keylogging to…](https://intel.threadlinqs.com/threat/TL-2026-2901) — high — 2026-10-04
- [Atomic macOS (AMOS) Stealer Delivered via Malicious Ad Impersonating Claude Code (ClickFix-style)](https://intel.threadlinqs.com/threat/TL-2026-2916) — high — 2026-10-02
- [Malicious ChatGPT Custom GPT "Plus 5.6" Used in ClickFix Campaign Delivering RAT via DLL Sideloading of…](https://intel.threadlinqs.com/threat/TL-2026-2766) — high — 2026-09-29
- [Malicious Google Ads Campaign Targets Ledger Hardware Wallet Users to Steal BIP-39 Recovery Phrases via…](https://intel.threadlinqs.com/threat/TL-2026-2673) — high — 2026-09-26
- [Attackers Manipulate AI Chatbots (ChatGPT, Gemini, Copilot, AI Overviews) via SEO/Content Poisoning for Mass…](https://intel.threadlinqs.com/threat/TL-2026-2631) — high — 2026-09-23
- [Fake Claude Max Giveaway Phishing Campaign Uses Browser-in-the-Browser to Steal Google Credentials](https://intel.threadlinqs.com/threat/TL-2026-2627) — medium — 2026-09-23
- [Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026), Actively Exploited V8 Type Confusion](https://intel.threadlinqs.com/threat/TL-2026-2326) — high — 2026-09-04
- [JSCeal Cryptocurrency Stealer: Check Point Details Static Deobfuscation of Compiled V8 Bytecode Payloads](https://intel.threadlinqs.com/threat/TL-2026-2259) — high — 2026-08-31
- [Infostealer Malware Hijacks Claude Login Sessions to Bypass MFA and Drain Usage; Related FakeAgent…](https://intel.threadlinqs.com/threat/TL-2026-2249) — high — 2026-08-30
- [Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware](https://intel.threadlinqs.com/threat/TL-2026-2197) — high — 2026-08-29
- [Fake OpenAI Codex Download Pages on Google Sites Deliver ClickFix macOS Stealer Tied to Atomic Stealer…](https://intel.threadlinqs.com/threat/TL-2026-2138) — high — 2026-08-25
- [Illegal IPL Betting Platform Network: 1,200+ Domains, Deepfake Celebrity Endorsements, and Systematic…](https://intel.threadlinqs.com/threat/TL-2026-2126) — high — 2026-08-23
- [Sophos X-Ops: Attackers Impersonate Claude, ChatGPT, Copilot and Perplexity to Distribute Infostealers…](https://intel.threadlinqs.com/threat/TL-2026-2120) — high — 2026-08-23
- [Deepfake Investment Scam Ads Funnel Victims Into Fake-Analyst WhatsApp Groups (GoldBull, CoinLure)](https://intel.threadlinqs.com/threat/TL-2026-2109) — high — 2026-08-21
- [Expired-Domain Resale Abuse Fuels Malware Delivery: Sable Squirrel and Scavenger Threat Clusters (Quasar…](https://intel.threadlinqs.com/threat/TL-2026-2033) — medium — 2026-08-16
- [Payroll Pirates (Storm-2755) Abuse Microsoft Graph for HR/Finance Staff Recon After AiTM Account Compromise](https://intel.threadlinqs.com/threat/TL-2026-1970) — high — 2026-08-10
- [Microsoft 365 AitM Phishing Campaign Hijacks Sessions via Residential Proxies to Harvest Payroll and Finance…](https://intel.threadlinqs.com/threat/TL-2026-1930) — high — 2026-08-07
- [Pre-Release Domain Abuse Campaign Targets GTA 6 (Grand Theft Auto VI) — 922 Malicious Domains Across…](https://intel.threadlinqs.com/threat/TL-2026-1816) — high — 2026-08-02
- [ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT, Infostealer, and Malicious Chrome Extension…](https://intel.threadlinqs.com/threat/TL-2026-1800) — high — 2026-07-31
- [SourTrade Malvertising Campaign Assembles Windows Malware In-Browser via ServiceWorker/SharedWorker…](https://intel.threadlinqs.com/threat/TL-2026-1687) — high — 2026-07-25
- [Russian Bulletproof Hosting Operators Indicted: Media Land / ML.Cloud Facilitated $62M+ in Ransomware…](https://intel.threadlinqs.com/threat/TL-2026-1580) — high — 2026-07-20
- [Mass Phishing/Fraud Campaign Impersonating Anthropic Claude and Mythos Brands (3,188 Malicious Domains)](https://intel.threadlinqs.com/threat/TL-2026-1521) — high — 2026-07-19
- ["PromptFiction" Claude Desktop Auto-Submit Flaw Chained With "Claudy Day" Claude.ai Exploit Chain Enables…](https://intel.threadlinqs.com/threat/TL-2026-1380) — high — 2026-07-15
- [FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644…](https://intel.threadlinqs.com/threat/TL-2026-1232) — critical — 2026-07-11
- [HalluSquatting: AI Coding Assistant Hallucinations Weaponized to Deliver Botnet Malware via Fake…](https://intel.threadlinqs.com/threat/TL-2026-1164) — medium — 2026-07-10
- [ClickFix Social-Engineering Technique Becomes Dominant Malware Delivery and Defense-Evasion Vector…](https://intel.threadlinqs.com/threat/TL-2026-1127) — high — 2026-07-05
- [Verified X Ad Spreads Mac Infostealer (Atomic Stealer Variant "MacSync"/DigitStealer) via Fake DynamicLake…](https://intel.threadlinqs.com/threat/TL-2026-1095) — high — 2026-07-03
- [OXLOADER Malware Loader Delivering CASTLESTEALER .NET Infostealer via Node.js Malvertising](https://intel.threadlinqs.com/threat/TL-2026-0857) — high — 2026-06-18
- [GHOST STADIUM — FIFA World Cup 2026 Phishing Operation: 4,300+ Fraudulent Domains and 300+ Cloned fifa.com…](https://intel.threadlinqs.com/threat/TL-2026-0704) — high — 2026-06-07
- [MacSync macOS Infostealer Delivered via Google Ads + Weaponized Claude.ai Shared Chats Impersonating Apple…](https://intel.threadlinqs.com/threat/TL-2026-0491) — high — 2026-05-10

## Related CVEs

CVEs referenced by the tracked threats that use T1583.008, most frequent first.

- [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379)
- [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684)
- [CVE-2022-41328](https://intel.threadlinqs.com/cve/CVE-2022-41328)
- [CVE-2022-42475](https://intel.threadlinqs.com/cve/CVE-2022-42475)
- [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997)
- [CVE-2023-48788](https://intel.threadlinqs.com/cve/CVE-2023-48788)
- [CVE-2024-21762](https://intel.threadlinqs.com/cve/CVE-2024-21762)
- [CVE-2024-40766](https://intel.threadlinqs.com/cve/CVE-2024-40766)
- [CVE-2024-53704](https://intel.threadlinqs.com/cve/CVE-2024-53704)
- [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591)
- [CVE-2025-27152](https://intel.threadlinqs.com/cve/CVE-2025-27152)
- [CVE-2025-59718](https://intel.threadlinqs.com/cve/CVE-2025-59718)
- [CVE-2025-59719](https://intel.threadlinqs.com/cve/CVE-2025-59719)
- [CVE-2025-68686](https://intel.threadlinqs.com/cve/CVE-2025-68686)
- [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858)
- [CVE-2026-85046](https://intel.threadlinqs.com/cve/CVE-2026-85046)

## Detection coverage

Threadlinqs maintains 52 detection rules mapped to T1583.008 (SPL 16, KQL 17, Sigma 19). Rule content is available to Blue tier accounts and above; this page shows counts only.

52 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Parent technique

[T1583 Acquire Infrastructure](https://intel.threadlinqs.com/technique/T1583) — 611 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1583.008
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)