Sniper’s Nest: From Brand Impersonation to Browser Hijacking and CPA Fraud

**Executive summary:** Group-IB exposes "SniperDz", a centralized PNaaS/PhaaS affiliate ecosystem that uses social-media impersonation and trusted link-aggregation services to funnel victims into multi-stage scams (phishing, browser push-notification abuse, premium SMS/call fraud and investment scams), employing cloaking, browser history manipulation, tab-under redirects and a recurring VAPID key to evade detection and link campaigns across more than 900 suspicious domains.