ScamClub
- First seen
- 2018-01-01 00:00:00
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- team
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:10:38
Targeted industries: technology-and-telecommunications retail-and-hospitality media-and-entertainment
Context
ScamClub is a threat actor involved in malvertising activities since 2018. They target the Mobile Web market segment, particularly on iOS devices, where security software is often lacking. ScamClub utilizes obfuscation techniques and real-time bidding integration with ad exchanges to push malicious JavaScript payloads, leading to forced redirects and various scams such as phishing and gift card scams.
Reports & references
- blog.confiant.com — Exploring Scamclub Payloads Via Deobfuscation Using Abstract Syntax Trees 65Ef7F412537 (report)
- malwarebytes.com — Associated Press Espn Cbs Among Top Sites Serving Fake Virus Alerts (report)