State of Ad Fraud 2026: AI-Assisted Schemes, Malicious iOS Scripts and Messenger Phishing Displace Cloaking

Key facts

Detection coverage

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4759 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-4759 Messenger-Referred Payload Download or Community-Observed Malvertising Infrastructure

Behaviour-first proxy search for the delivery stage of the ADEX State of Ad Fraud 2026 trend (TL-2026-4759): installer or script payloads (msi, exe, zip, iso, hta, js) downloaded with a WhatsApp or Telegram referrer, payloads served from public r2.dev buckets, and traffic to community-observed sibling infrastructure such as cutstudios.life, mediagetapp.com, teams-microsoft-downloads.com and the streambam*.cyou domains. Indicators are community-tier (TL_OSINT_Scan) corroboration, not ground truth.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.003, T1204.001, T1189
• Data sources: zscaler_nss_web_proxy, proxy
• Severity: medium
• Confidence: medium

Splunk SPL

index=proxy sourcetype="zscalernss-web" earliest=-24h
| eval dest_domain=lower(coalesce(dest_host, url_domain, host))
| eval ref=lower(coalesce(http_referrer, referer, ""))
| eval uri=lower(coalesce(url, uri_path, ""))
| eval src_user=coalesce(user, cs_username, "unknown"), src=coalesce(src_ip, cip, "unknown")
| eval msgr_ref=if(match(ref, "^https?://(web\.whatsapp\.com|api\.whatsapp\.com|wa\.me|t\.me|web\.telegram\.org)(/|$)"), 1, 0)
| eval payload=if(match(uri, "\.(msi|exe|zip|iso|hta|js)(\?|$)"), 1, 0)
| eval community_ioc=if(match(dest_domain, "(^|\.)(cutstudios\.life|onlinecapcutedit\.top|relay\.goruf\.top|teams-microsoft-downloads\.com|update\.zip|adserverworkshub\.com|lake-90\.com|balladcompass11\.com|streambambam\.cyou|streambambino\.cyou|streambanana\.cyou|werefilledwit\.org|mediagetapp\.com|pub-209ca94c79b043bea60b0f7868222cd4\.r2\.dev|pub-1e489e802c044438b77b5f3eb2390c68\.r2\.dev)$"), 1, 0)
| eval r2_payload=if(match(dest_domain, "^pub-[0-9a-f]{32}\.r2\.dev$") AND payload=1, 1, 0)
| where community_ioc=1 OR r2_payload=1 OR (msgr_ref=1 AND payload=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_domain) as domains values(uri) as uris values(ref) as referrers by src_user src
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")

Microsoft KQL

let CommunityIocs = dynamic(["cutstudios.life", "onlinecapcutedit.top", "relay.goruf.top", "teams-microsoft-downloads.com", "update.zip", "adserverworkshub.com", "lake-90.com", "balladcompass11.com", "streambambam.cyou", "streambambino.cyou", "streambanana.cyou", "werefilledwit.org", "mediagetapp.com", "pub-209ca94c79b043bea60b0f7868222cd4.r2.dev", "pub-1e489e802c044438b77b5f3eb2390c68.r2.dev"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(DestinationHostName)
| extend DestDomain = tolower(DestinationHostName), Uri = tolower(RequestURL), Ref = tolower(RequestContext)
| extend Payload = Uri matches regex @"\.(msi|exe|zip|iso|hta|js)(\?|$)"
| extend MsgrRef = Ref matches regex @"^https?://(web\.whatsapp\.com|api\.whatsapp\.com|wa\.me|t\.me|web\.telegram\.org)(/|$)"
| extend CommunityIoc = DestDomain has_any (CommunityIocs)
| extend R2Payload = DestDomain matches regex @"^pub-[0-9a-f]{32}\.r2\.dev$" and Payload
| where CommunityIoc or R2Payload or (MsgrRef and Payload)
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Domains = make_set(DestDomain, 10), Urls = make_set(RequestURL, 10) by SourceIP, SourceUserName
| order by Hits desc

Sigma

title: TL-2026-4759 Messenger-Referred Payload Download or Community-Observed Malvertising Infrastructure
id: 7c1e4b52-3a9d-4f6e-8b21-5d0a9c7e1f01
status: experimental
description: Detects proxy-logged downloads of installer or script payloads referred from WhatsApp or Telegram, downloads from public r2.dev buckets, and any traffic to community-observed malvertising and fake-installer infrastructure related to the ADEX State of Ad Fraud 2026 trend.
references:
    - https://cybersecuritynews.com/state-of-ad-fraud-2026-52-of-schemes-use-ai-as-cloaking-loses-ground-to-ios-exploits-and-messenger-phishing/
author: Threadlinqs Team
date: 2026-10-29
tags:
    - attack.initial_access
    - attack.t1566.003
    - attack.t1189
    - attack.execution
    - attack.t1204.001
logsource:
    category: proxy
detection:
    selection_ioc:
        cs-host|endswith:
            - 'cutstudios.life'
            - 'onlinecapcutedit.top'
            - 'relay.goruf.top'
            - 'teams-microsoft-downloads.com'
            - 'update.zip'
            - 'adserverworkshub.com'
            - 'lake-90.com'
            - 'balladcompass11.com'
            - 'streambambam.cyou'
            - 'streambambino.cyou'
            - 'streambanana.cyou'
            - 'werefilledwit.org'
            - 'mediagetapp.com'
            - 'pub-209ca94c79b043bea60b0f7868222cd4.r2.dev'
            - 'pub-1e489e802c044438b77b5f3eb2390c68.r2.dev'
    selection_ref:
        cs-referer|startswith:
            - 'https://web.whatsapp.com'
            - 'https://api.whatsapp.com'
            - 'https://wa.me'
            - 'https://t.me'
            - 'https://web.telegram.org'
    selection_ext:
        c-uri-extension:
            - 'msi'
            - 'exe'
            - 'zip'
            - 'iso'
            - 'hta'
            - 'js'
    selection_r2:
        cs-host|re: '^pub-[0-9a-f]{32}\.r2\.dev$'
    condition: selection_ioc or (selection_ref and selection_ext) or (selection_r2 and selection_ext)
falsepositives:
    - Users legitimately sharing installers through WhatsApp Web or Telegram Web
    - Legitimate public r2.dev buckets hosting software downloads
    - Security researchers visiting listed community indicators
level: medium

Known false positives:

• Users legitimately sharing installers or archives through WhatsApp Web or Telegram Web
• Legitimate software distributed from public Cloudflare r2.dev buckets
• Researchers or red teams visiting listed community indicators

Tuning notes: Map field names to your proxy (dest_host, http_referrer, url, user, src_ip) or switch to the CIM Web datamodel with tstats. Keep the community domain list refreshed from TL_OSINT_Scan and expire stale entries. Allowlist known-good r2.dev bucket names and approved software-delivery referrers. update.zip collides with file-name noise, so keep it constrained to the host field.

• 🔒 TL-2026-4759 Payload Downloaded With Messenger or Community-Observed Origin (Mark-of-the-Web) · unlock with TL Creds
• 🔒 TL-2026-4759 Fake Installer Masquerading as CapCut, MediaGet or Teams Run From User Paths · unlock with TL Creds
• 🔒 TL-2026-4759 Web Server Process Writing Script Content Into Web Root · unlock with TL Creds
• 🔒 TL-2026-4759 Prize or Bonus Scareware Landing Page URL Pattern · unlock with TL Creds
• 🔒 TL-2026-4759 ClickFix-Style Run Dialog Command Fetching Remote Payload · unlock with TL Creds
• 🔒 TL-2026-4759 DNS Query to Brand-Impersonating Download Domain · unlock with TL Creds
• 🔒 TL-2026-4759 Script Interpreter Spawned by Browser or Messenger Client · unlock with TL Creds
• 🔒 TL-2026-4759 DNS Query to Community-Observed Malvertising and Fake Installer Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-10-29, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-4759.

Technical analysis

This is a trend-level threat intelligence entry derived from the ADEX Trust & Safety report 'State of Ad Fraud 2026', as reported by Cyber Security News on 2026-10-29. It is not a discrete incident: the source names no CVEs, malware families, threat actors, domains or IP addresses. The primary PDF is hosted on Google Drive and could not be rendered for independent verification, so every figure below is as reported by the secondary source and should be treated as vendor-reported, single-source data.

Scope and headline findings: ADEX analysed January-September 2026 data from eight ad platforms covering 1.2 million campaigns and 4.9 million creatives. 52% of distinct fraud schemes involved AI-generated or AI-assisted assets. Within those AI-involved schemes, 64% deployed bots that mimic human visitors, 53% used cloned brands and fake endorsements, and 11% incorporated deepfakes. ADEX's CPO Sergey Martianov is quoted as saying one well-made scam with a cloned brand page does more damage than a hundred crude ones.

Shift away from cloaking: cloaking-related suspensions fell from roughly 75% (2025/Q1 2026) to roughly 45% by Q3 2026. Malicious iOS scripts, not tracked in the earlier period, accounted for about 20% of Q3 suspensions and became a primary suspension driver. Infected (compromised) domains accounted for about one-third of rejections and were the top rejection reason from Q2 onward. Prize/bonus scareware ('You won a smartphone') represented 6% of Q3 rejections. Other Q3 shifts: copyright rejections 8% to 21%, region-restricted content 5% to 11%, adult content 42% to 14%. Overall campaign rejection/blocking fell by about one-third after Q1, which ADEX attributes to operators submitting fewer, higher-quality campaigns.

Channels and geography: messenger-based phishing on WhatsApp and Telegram is called out as a rising delivery channel. High-risk regions: Tier-1 markets (US, UK, Canada, Australia, Germany) consistently; South Asia from Q2; Turkey in H1; Latin America with a Q1 spike; East Asia emerging in Q3.

ADEX 2027 forecasts: ads designed for AI agents using prompt injection; agent traffic blurring the line between bots and legitimate buyers; end-to-end AI-generated fraud operations; increased exploitation of hacked domains and messenger funnels; scareware expansion to connected TV, in-app and AI assistant interfaces. Prompt injection is a forecast only and was not measured in 2026.

Industry context (third-party, separately sourced): the Thales 2026 Bad Bot Report found bots were 53% of web traffic in 2025 (40% of that malicious), a 12.5x year-over-year rise in AI-enabled bot attacks, and 17.2 trillion blocked bot requests. HUMAN Security's 2026 State of AI Traffic report found monthly AI-driven traffic grew 187% from January to December 2025, with agentic AI traffic up 7,851% year over year.

Defender relevance: ad-platform trust and safety teams, brand-protection teams, mobile security teams and SOCs should expect cloned-brand landing pages, human-mimicking bot traffic, compromised publisher/advertiser domains serving malicious scripts to iOS users, and WhatsApp/Telegram funnels. Confidence is low-to-moderate because the data is single-source and vendor-reported.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1684.001 Impersonation

Execution

T1059 Command and Scripting Interpreter; T1204.001 Malicious Link

Initial Access

T1566.003 Spearphishing via Service

Resource Development

T1584.001 Domains

Impact

T1657 Financial Theft

Remediation

Immediate actions

• Block or review ad creatives and landing pages that clone known brands or use fake endorsements
• Flag prize/bonus scareware landing pages ('You won a smartphone' style) for takedown
• Warn users and staff about unsolicited WhatsApp and Telegram messages containing links
• Audit owned and affiliate domains for compromise or injected third-party scripts

Workarounds

• Restrict messenger link handling on managed iOS devices via MDM and mobile threat defense
• Use ad-platform brand-safety and impersonation reporting channels

Longer-term hardening

• Deploy bot-management that does not rely on cloaking signals alone and detects human-mimicking automated traffic
• Adopt domain and script integrity monitoring (CSP, SRI, change detection) on advertising landing infrastructure
• Add deepfake and cloned-brand detection to ad review and brand-protection workflows
• Plan for prompt-injection exposure in AI agents that consume ad content, as forecast by ADEX for 2027

Affected and fixed versions

• Multiple — Online advertising platforms (eight platforms in ADEX dataset, unnamed in source)
  Vulnerable versions: Not version-specific
• Apple — iOS users targeted by malicious scripts (no vulnerability identified in source)
  Vulnerable versions: Not specified
• Meta / Telegram — WhatsApp and Telegram (abused as phishing delivery channels, not vulnerable)
  Vulnerable versions: Not applicable

Timeline

• 2026-01-01 Start of the ADEX observation window (January-September 2026) covering eight ad platforms, 1.2 million campaigns and 4.9 million creatives; cloaking still accounts for roughly 75% of suspensions in the 2025/Q1 baseline.
• 2026-03-31 Latin America shows a Q1 spike in high-risk ad activity; Turkey elevated through H1; campaign rejection volume then falls by about one-third after Q1 as operators submit fewer, higher-quality campaigns.
• 2026-04-01 From Q2 onward infected domains become the top rejection reason (~one-third of rejections) and South Asia becomes a high-risk region.
• 2026-05-20 Press coverage of the Thales 2026 Bad Bot Report: bots were 53% of web traffic in 2025, with a 12.5x rise in AI-enabled bot attacks (industry context).
• 2026-07-01 Q3 2026: cloaking suspensions fall to ~45%, malicious iOS scripts reach ~20% of suspensions, prize/bonus scareware reaches 6% of rejections, and East Asia emerges as a risk region.
• 2026-09-30 End of the ADEX data window; 52% of distinct fraud schemes in the period involved AI-generated or AI-assisted assets (64% human-mimicking bots, 53% cloned brands/fake endorsements, 11% deepfakes).
• 2026-10-29 Cyber Security News reports the ADEX State of Ad Fraud 2026 Trust & Safety Report, including 2027 forecasts of prompt-injection ads aimed at AI agents and end-to-end AI-generated fraud operations.

Sources cited

• ADEX State of Ad Fraud 2026 (Trust & Safety Report, PDF) drive.google.com · Research · 2026-10-29
• Thales 2026 Bad Bot Report cpl.thalesgroup.com · Vendor report
• AI-driven Bot Attacks Surged 12.5x According to Thales Bad Bot Report thalesgroup.com · Vendor report
• HUMAN Security: The 2026 State of AI Traffic & Cyberthreat Benchmark Report humansecurity.com · Vendor report
• State of Ad Fraud 2026: 52% of Schemes Use AI as Cloaking Loses Ground to iOS Exploits and Messenger Phishing cybersecuritynews.com · News · 2026-10-29
• Bots make up 53% of web traffic, Thales report says (IT Brief) itbrief.com.au · News
• HUMAN Security reports AI traffic surged 187% in 2025 as bots eclipsed human users implicator.ai · News

More in threat intel

• School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)
• Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709
• Lazarus: Weight-Space Backdoor Technique Hidden in Dormant AI Model Neurons (Microsoft Research)
• QuoIntelligence Weekly Snapshot W39 2026: ClickFix/Exvicy, Graphalgo Go RAT, RemControl Android trojan, Windows Defender zero-day exploit (Nightmare Eclipse)
• CRAFTY FALCON: AI-Assisted Financial Threat Actor Targeting Indian BFSI (CERT-In CIAD-2026-0058)

Previous and next in threat intel

• Cisco Open-Sources Quarry to Detect AI Agent Attacks Hidden in Individually Benign Steps (GTG-1002 and Mexican Government Claude Code Abuse Context) Previous report
• US Election Security: Voting Machine Patch Gaps and AI-Enabled Influence Campaigns Next report

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors