Dark Adtech Empire: The Fake CAPTCHA Secret

The Shocking Truth Behind "Breaking Bad"-Themed Malware: How a Fictional Drug Empire Inspired a Real-World Cybercrime Ring **Did you know a seemingly innocent online ad network, styled after the hit show "Breaking Bad," is secretly fueling a massive global disinformation campaign?** This isn't just another phishing scam; it's a sophisticated operation involving Kremlin-backed influence, malicious ad tech, and a shocking level of international collaboration among cybercriminals. Learn how this insidious network works and protect yourself from its devastating consequences. "Los Pollos" – A Chicken Restaurant…or a Malware Machine? Late last year, security researchers uncovered a startling truth: a disinformation network, dubbed "Doppelganger," was spreading pro-Russian propaganda across Europe. This wasn't some amateur operation. Doppelganger used advanced domain cloaking—a technology that hides its true nature from search engines—to stay one step ahead of detection. But the story gets even more twisted… Doppelganger's cloaking service, a seemingly innocuous piece of ad tech, wasn't alone. It shared infrastructure with VexTrio, the oldest known malicious traffic distribution system (TDS), a digital swamp teeming with phishing scams, malware, and more. And at the heart of this digital darkness? LosPollos[.]com and TacoLoco[.]co – two affiliate marketing services brazenly mimicking the iconic "Los Pollos Hermanos" from "Breaking Bad." A "Breaking Bad" Brand: Disinformation Dressed as Dinner The LosPollos ad network, complete with a logo featuring Gustavo Fring himself, isn't selling chicken. It's selling malware-laced "smartlinks" to unsuspecting affiliates. These links, injected into hacked WordPress sites, funnel unsuspecting users into VexTrio's web of deceit. The reward? A small commission for every click leading to dating scams, fake apps, and financial fraud. The Ghost in the Machine: Push Notifications and the TacoLoco Trap TacoLoco, another player in this dark ecosystem, uses deceptive tactics to trick users into accepting push notifications. These notifications, disguised as CAPTCHAs, aren't harmless updates. They're the gateway to a relentless barrage of fake virus alerts and misleading pop-ups, relentlessly bombarding victims' devices. Remember that almost 40% of compromised websites in 2024 redirected users to VexTrio through LosPollos? That's not just a statistic; it's a chilling testament to the scale of this operation.

Image 1

Unmasking the Masterminds: Adspro, Cerutti, and a Web of Deception The trail led researchers to Adspro Group, a company registered in the Czech Republic and Russia, operating its infrastructure through Swiss hosting providers. The owner, Giulio Vitorrio Leonardo Cerutti, also runs ByteCore AG and SkyForge Digital AG, the copyright holders for LosPollos and TacoLoco. Even more alarming: Cerutti's company, Holacode, developed the apps, including a VPN and a supposedly anti-spam app called Spamshield, which later rebranded to ApLabz but still shows lingering traces of its original name in its Terms of Service. Incredibly, Cerutti threatened legal action *before* being contacted for comment! He vehemently denies any connection to VexTrio, claiming to be a victim of "publisher fraud." But the evidence paints a very different picture. The Domino Effect: A Shift in the Dark Ad Tech Landscape The fallout was swift. Just days after the investigation was published, LosPollos suspended its push monetization service, and Adspro rebranded to Aimed Global. But the story doesn't end there. Malware like DollyWay, which had long redirected victims to VexTrio, suddenly switched allegiance to another TDS—Help TDS—revealing a complex, interconnected web of malicious actors. Infoblox's research linked VexTrio and Help TDS to at least four other Russia-based push monetization programs, all with a Russian connection, pushing mostly online dating schemes. The Bigger Picture: Russian Organized Crime and the Malicious Ad Tech Industry This isn't just about a few bad actors; it's about a sophisticated network controlled by Russian organized crime. These malicious TDSs are the delivery mechanisms for information stealers and scams costing consumers billions annually. Renee Burton, VP of Threat Intelligence at Infoblox, highlights the security industry's blind spot: the deceptive methods used are often treated as a "legally grey area." But this myopic view perpetuates a dangerous system. Protect Yourself: Take Control of Your Notifications You can fight back. Be cautious when accepting website notifications. Major browsers allow you to block notification requests entirely, or on a per-website basis. Take the time to learn how to manage these settings on your devices, especially for those less tech-savvy friends and family members. Your digital security depends on it. **(Instructions on how to disable notification requests in Firefox, Chrome, and Safari follow here.)**

Image 2