Malvertiser Makes the Big Bucks on Black Friday

Confiant’s broad coverage in ad tech gives us visibility on some of the darkest corners of the ecosystem. We are strong believers that to truly fight malvertisers, we have to understand their motives. Sometimes this brings us to researching some long standing and large scale (but neglected) attacks. While ad fraud is not normally our core focus at Confiant, we are always invested in exposing how threat actors use the programmatic process and ad networks for malicious purposes. Confiant has observed a cookie stuffing campaign running across multiple programmatic ad platforms with a specific uptick in Q4 around Black Friday. We refer to the actor behind this campaign as DatalyMedia, based on one of the legal entities they operate.

What is cookie stuffing?

Cookie stuffing is a form of ad fraud where the malicious campaign triggers arbitrary numbers of invalid ad conversions by generating fake clicks. Cookie stuffing can target cost-per-click (CPC) ad campaigns and various types of cost-per-lead (CPL) and cost-per-action (CPA) campaigns. Cookie stuffing is a source of invalid traffic (IVT) i.e.: ad fraud.

The common way to generate these fake clicks is to surreptitiously load click URLs in hidden iframes inside the ad as it renders.

Risks of cookie stuffing

For advertisers: Cookie stuffing skews targeted data and degrades campaign performance

For publishers: Cookie stuffing causes significant page latency due to massive network load when advertising landing pages load in hidden iframes

For both:
• Lack of user consent for the rogue tracking / privacy compliance violations create liabilities
• Fake conversions from cookie stuffing steal money from the ad ecosystem

According to our internal data, DatalyMedia has been specializing in affiliate marketing fraud (by executing cookie stuffing schemes) since at least 2015. Much of the infrastructure, tactics and techniques employed have remained rather stable over time.

We have identified four legal entities who have been involved in the DatalyMedia cookie stuffing scheme:
• Just Media Group (fka JustClick Media)
• Dataly Media
• Eficads
• Tredia Solutions

In addition to the techniques presented below, DatalyMedia has be

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.