VexTrio Viper

VexTrio Viper is a cybercriminal threat actor centered on malicious advertising technology and traffic distribution system (TDS) operations. The content describes it as operating a large TDS infrastructure since early 2020 and running one of the most extensive known cybercriminal affiliate programs, with reporting citing over 65 affiliates in one source and over 165 affiliates in another. Reported affiliates or associated partners include GoRefresh, SocGholish, and ClearFake. Los Pollos is described as a malicious advertising technology company operating under the VexTrio Viper umbrella. The actor has been observed using compromised and hijacked domains to route traffic through its TDS, including domains taken over via the Sitting Ducks DNS hijacking technique. Reporting states VexTrio Viper first hijacked a domain using Sitting Ducks in early 2020 and has hijacked domains across multiple DNS services. Its stolen or compromised domains are used for redirection, scam delivery, and broader malicious infrastructure operations. Observed tactics and techniques in the provided content include multi-stage redirect chains, device and geolocation profiling, fake robot CAPTCHA lures, abuse of browser push-notification permissions, and use of compromised websites with minimal injected code to funnel victims into TDS workflows. The content links VexTrio Viper to push-notification abuse that can generate high-volume deceptive alerts and route users to fake giveaways, fake dating sites, fake surveys, fake crypto-mining sites, fake apps or adware, malware delivery, disinformation, and antivirus scareware flows. Example redirect chains involve multiple intermediary domains before final destinations, and the actor’s infrastructure is described as tailoring payloads based on device and location. The content also states that VexTrio Viper has developed malicious applications that were published on Apple and Google official app storefronts while posing as useful apps. VexTrio Viper is not described in the provided content as a nation-state actor. The reporting instead characterizes it as a financially motivated cybercriminal ecosystem focused on adtech abuse, traffic monetization, scam enablement, and affiliate-driven malicious redirection.