Savvy Seahorse gang uses DNS CNAME records to power investor scams

Infoblox researchers detail a campaign by a threat actor dubbed Savvy Seahorse that uses abused DNS CNAME records as a traffic-distribution system (CNAME TDS), domain-generation and wildcard DNS techniques, and IP rotation to run multilingual Facebook-ad-driven investment scams; victims are steered to fraudulent registration pages and fake trading platforms assisted by chatbots to harvest personal and financial data and collect payments.