Keitaro Tracker Misused in 15,500 AI Scam Domains

• •15,500 malicious domains linked to Keitaro tracker identified over four months.
• •Investment scams framed as AI trading offers are the most common type of fraud observed.
• •Cloaking techniques are used to evade detection by showing harmless content to some users.

Cybercriminals are exploiting the Keitaro advertising tracker to facilitate online scams, with researchers identifying 15,500 malicious domains linked to this activity over four months. The primary focus of these scams is investment fraud, particularly schemes promoting AI trading technologies that promise high returns. The study, conducted by Infoblox Threat Intel and Confiant, highlights the use of domain cloaking techniques that allow operators to present benign content to some users while redirecting targeted victims to harmful sites. This misuse of commercial marketing software reflects a broader trend in cybercrime, where off-the-shelf tools are increasingly adopted to enhance the effectiveness and scalability of fraudulent operations. The research indicates that even though Keitaro no longer supports cloaker integrations, threat actors continue to exploit its existing features. The findings emphasize the growing sophistication of cybercriminals who are leveraging generative AI to produce tailored content for their scams. The overall impact of this activity poses significant risks to potential victims who may be lured into fraudulent schemes.