D-Shortiez

D-Shortiez is a malvertising threat actor tracked by Confiant since 2022. The group runs forced-redirect campaigns that push victims through malicious click-chains to scam pages. Reported scam themes include Google gift card scams, Amazon giveaway scams, and Microsoft Windows-branded tech support scams. Confiant attributed the reward-scam and tech-support-scam activity to the same operator based on shared domains, identical document locations, and shared tooling, including use of the Binom traffic distribution system (TDS). Windows users were reportedly served tech support scams, while mobile users were served reward scams. The actor’s redirect payload was described as containing fingerprinting and tracking functions plus nested try/catch redirect logic designed to maximize cross-browser forced redirection. A notable technique was browser history manipulation using window.top.history.pushState and a window.top.onpopstate handler to hijack the back button and keep victims trapped on scam pages. Testing found Safari, particularly on iOS, was especially affected by this behavior. The technique was compared to browlock-style trapping. Apple was reportedly notified and later addressed the Safari issue in security update HT213600. The activity has operated at scale. Content states D-Shortiez served more than 300 million malicious ad impressions over a six-month period, primarily targeting the United States, with additional victims in Canada and Europe. Separate reporting in the provided content states the actor served 59 million malicious ad impressions in 2025, with more than 95% targeting the United States. Campaign activity was described as persistent, with bursts of aggressive delivery separated by pauses. iOS was identified as the predominant target platform in the forced-redirect campaigns. Confiant reported discovering exposed internal testing and administrative pages used by D-Shortiez in 2025, which revealed newly staged domains, campaign-management details, ad tags, and infrastructure patterns. The content notes Chinese-language comments in the test page, credentials referencing the Chinese-only Baota/Pagoda panel (bt.cn), and an update schedule consistent with Chinese-speaking operators. This is described as consistency evidence only; the content does not state a nation-state attribution. Known alias in the provided content: d_shortiez.