At the request of the Dutch public broadcasting company NOS, two experts of DataExpert and Infoblox investigated a wave of spammy, sexualized GIF comments on Instagram. They uncovered a coordinated campaign tied to an affiliate of the cybercriminal network VexTrio. These seemingly harmless GIFs were designed to lure users towards malicious websites, with traffic routed through infrastructure typical of a Traffic Distribution System (TDS). Using different techniques, they traced links between comment spam, infected infrastructure, and broader monetization tactics. This case illustrates how cybercriminals weaponize adtech ecosystems to both exploit users, monetize this, and undermine trusted digital platforms.
