VexTrio TDS: Inside a massive 70,000-domain cybercrime operation

Infoblox researchers uncovered VexTrio, a prolific Traffic Distribution System active since at least 2017 that leverages ~70,000 compromised sites and roughly 60 affiliate partners to funnel web visitors to malicious destinations (phishing, exploit kits, malware). The report outlines VexTrio's techniques — injected redirect scripts, blackhat SEO, intermediary redirection, and deceptive push-notification/"robot CAPTCHA" flows — and documents ties to known campaigns like SocGholish and ClearFake, highlighting its scale, persistence, and difficulty to mitigate.