Summary:
Recently, Proofpoint identified two new actors, TA2726 and TA2727, involved in web-based malware distribution. TA2726 functions as a TDS operator, selling traffic to other threat actors, including TA569 and TA2727. Since at least September 2022, TA2726 has redirected users based on geography, with North American users being served TA569’s SocGholish injects, while others received malware such as Lumma Stealer for Windows, DeerStealer for Windows, FrigidStealer for Mac, and Marcher for Android. Unlike traditional phishing campaigns, TA2726 does not conduct email-based attacks; instead, legitimate but compromised websites unknowingly distribute its malicious content.

TA2727, a financially motivated threat actor, specializes in malware distribution through fake update lures. First identified by Proofpoint in January 2025, TA2727 has been observed using compromised websites to distribute different payloads based on user location and platform. Windows users in Europe were served DOILoader via a trojanized MSI file, while Android users were targeted with the Marcher banking trojan. Notably, Mac users were infected with FrigidStealer, a newly identified information stealer. Disguised as a browser update, FrigidStealer prompts users to enter their Mac password, then exfiltrates browser cookies, credentials, and cryptocurrency-related files to a command-and-control server.

Security Officer Comments:
Malicious web inject campaigns have become increasingly complex, with multiple threat actors leveraging this method to distribute malware. These attacks typically follow a three-stage process: malicious JavaScript injects are embedded into compromised websites, a Traffic Distribution System determines which users receive specific payloads, and the final malware is downloaded onto the victim’s device. Historically, TA569 was the primary actor using SocGholish injects to deploy fake browser update lures, often leading to ransomware infections. However, since 2023, multiple copycat actors have adopted similar techniques, making it challenging to attribute attacks to specific groups.


Suggested Corrections:

The best mitigation is defense in depth. The following is recommended: