Confiant and Infoblox: Cybercriminals Systematically Use the Keitaro Tracker in Fraudulent Campaigns

Confiant and Infoblox: Cybercriminals Systematically Use the Keitaro Tracker in Fraudulent Campaigns

The cybersecurity companies Confiant (monitoring ~90 billion ad impressions per month) and Infoblox (monitoring DNS infrastructure) published the first systematic study of abuses of the self-hosted Keitaro ad tracker (developed by Apliteni) based on four months of data from October 2025. The iGN editorial team highlights the following key data:

Scale:

• Researchers identified 15,500 malicious domains, with cybercriminals registering ~9,000 of them specifically for fraudulent campaigns
• Traffic came through programmatic, spam, social media, and hacked sites simultaneously
• Investment fraud dominates among the identified threats
• Fraudsters use AI for mass generation of landing pages, creatives, and deepfake videos primarily in Russian and English

FaiKast (Confiant has been tracking since May 2025):

• Fraudsters spread deepfake videos with AI news anchors through the Bigo Ads ad network, targeting France, the UK, Canada, Japan, and Kazakhstan, redirecting victims to copies of real media with fabricated quotes from public figures and fake cryptocurrency platforms

FishSteaks (Confiant has been tracking since at least March 2024):

• Fraudsters imitate giveaways on behalf of American consumer brands targeting the USA, gamifying landing pages, using domains in the .ru zone, and replacing placeholders with real brand logos when launching campaigns

Developer Response:

• Since August 2025, researchers have reported over 100 domains to Apliteni
• The company has blocked more than 12 fraudster accounts
• Among the violators, researchers found users of unlicensed copies of Keitaro, including TA2726
• The licensing terms of Keitaro prohibit «misleading» content

The head of security at Keitaro told researchers that the company combines operational responses to complaints with internal monitoring to detect malicious activity

This is the first of three parts of the study. Despite Apliteni’s efforts, researchers note that fraudsters rotate domains and creatives faster than any single response channel can block them