From Spam to Scams: How VexTrio Built a Global Malicious AdTech Empire

Investigators discovered that Vextrio operated a network of fake websites and online advertisements for over a decade, managing nearly 100 companies across various sectors, including adtech, mobile apps, construction, and even ski resorts. This extensive operation was designed to conceal its massive ad-fraud business. Security researchers at Infoblox uncovered the group’s intricate network of front companies, clicking systems, and traffic distribution systems (TDS) that directed unsuspecting users into scams.

Data Protection and DPDP Act Readiness: Hundreds of Senior Leaders Sign Up for CDPO Program

The Infrastructure Behind the Fraud

At its core is a robust traffic distribution system that routes billions of web users daily to malicious content—like fake antivirus downloads, dating scams, phishing sites, and crypto fraud. Operating with fewer than 250 virtual machines, VexTrio controls over 70,000 compromised domains and brokers traffic for more than 60 affiliates, including notorious malware campaigns like ClearFake and SocGholish.

Technical Mastery and Deceptive Reach

Equipped with DevOps tools like Terraform, Kubernetes, and GitLab, VexTrio delivers value and anonymity. It also uses cloaking technologies and smart link generators via affiliate brands like Los Pollos, Taco Loco, and Adtrafico. These front ad networks appear legitimate but act as gateways into their criminal ecosystem.

Infoblox identified several figures linked to VexTrio—including Giulio Cerutti, Igor Voronin, and others—whose ties span Switzerland, Czechia, Bul­garia, and Canada. Their identities were traced through corporate filings, trademarks, and digital breadcrumbs.

VexTrio’s deceptive design—from fake dating platforms to mainstream-sounding brands—allowed it to evade detection for years. Its reach is estimated to touch over 40% of compromised websites globally, with massive user bases advertised under the Los Pollos affiliate network.