Distributed Crawler Poses as Human Visitor to Evade Analytics and Ad Filters
A site owner watching traffic graphs climb while advertising revenue stayed flat would normally celebrate algorithmic success. In this case the numbers told a different story: Google Analytics recorded new sessions, the server performed full TLS handshakes and dynamic page generation, yet no corresponding ad impressions were billed.
The discrepancy arises because GA4 accepts events via the Measurement Protocol, a server-to-server channel originally intended for offline interactions. A crawler that crafts the correct payload can register a session without ever rendering advertisements or executing the full browser resource chain of CSS, JavaScript, fonts and favicons.
Operators of a network of unrelated sites noticed the same subtle footprint on each property. Individual requests carried ordinary modern browser strings, arrived from search-engine referrers, and followed internal links at a human-like pace. Only when events were aggregated into a cross-site graph did the coordinated pattern emerge: dozens of IP addresses replaying nearly identical sequences while rotating User-Agent strings and never loading supporting page assets.
One particularly convincing candidate, masked as 203.0.113.0/24, produced roughly one hundred events over eight days. Its profile included search transitions, internal navigation, and a modest set of static resources. Raw logs, however, showed that almost half the requests openly declared themselves with the string “crawler” and that the supposed resources were exclusively images returning 404 responses without Referer headers.
Further examination of referrer data exposed additional contradictions. The same addresses claimed simultaneous arrivals from Google, Yandex, Bing and Baidu within minutes, an impossible sequence for any single human reader. Internal-link Referers were fabricated to simulate article-to-article reading, yet no stylesheets, scripts or actual page images were ever requested.
The investigation relied on a continuously updated graph whose vertices represented addresses, network blocks, browser masks and requested resources. Edges captured temporal and causal relationships, allowing analysts to test whether short, seemingly natural sessions on separate sites actually belonged to the same automated actor. GPU-accelerated processing made parallel comparison of hundreds of candidate biographies feasible.
The episode illustrates that server logs remain the only immutable record when analytics platforms and advertising systems can be fed synthetic events. By focusing on missing resource chains and contradictory origin stories rather than any single IP or country, defenders can surface distributed crawlers that have studied human browsing patterns in detail.
Related articles
GOFFEE Dissects Custom COW Agent Forked from Poseidon Mythic Implant
Angara Security researchers uncovered a custom Go-based Mythic C2 agent named COW used by the Russian-oriented APT group GOFFEE, also known as Paper Werewolf. The agent represents an independent development branch derived from the public Poseidon project rather than its Freyja fork. Samples were heavily protected with Garble obfuscation and a modified UPX packer that required manual header reconstruction for unpacking. Analysis of surviving strings, build paths, and architectural features confirmed Poseidon origins while revealing numerous custom modifications including Windows support, additional C2 profiles, and new command implementations. The group employs the agent alongside other tools such as PowerTaskel, MiRat, and BindSycler for persistent access to Linux and Windows systems across government, energy, telecom, and defense targets. Researchers traced multiple variants through VirusTotal and incident reports, documenting evolutionary changes in configuration handling and peer-to-peer communication mechanisms.
Manic Android Malware Steals PINs via Transparent Overlay and Relays Data Through Nearby Infected Devices
A newly identified Android malware strain named Manic merges banking trojan, spyware, and remote access capabilities. The threat has been active since at least February 2026 and continues to receive updates that add anti-analysis features, in-memory code loading, and lock-screen credential theft. Manic monitors 169 financial, messaging, and government applications while using a transparent overlay on legitimate numeric keyboards to capture PINs without displaying a full fake banking screen. Stolen data can be forwarded through other compromised nearby devices even when the original phone lacks internet connectivity. Operators also leverage WebRTC sessions for live screen viewing and remote interaction. The malware additionally functions as a keylogger, intercepts SMS and notifications, and collects passwords, one-time codes, and recovery phrases. Security researchers recommend avoiding unknown APKs and scrutinizing requests for Accessibility Services or broad device control permissions.
Armored Likho Expands Arsenal with BusySnake RAT and AI-Driven Malware Development
The cybercrime group Armored Likho has introduced a new multi-platform trojan called BusySnake RAT that targets Windows, Linux, and macOS systems. Researchers at Kaspersky Lab identified three distinct versions of the malware, evolving from a Python implementation using Telegram bots for command-and-control to a GitLab-based variant and finally a fully rewritten Go version. In addition to custom development, the group has incorporated the open-source Kharon RAT to facilitate remote access and data exfiltration. Armored Likho has also shifted its infrastructure to private GitHub and GitLab repositories to hinder analysis. Most notably, the group now leverages large language models not only for initial access but also to generate tools for persistence and post-exploitation activities. Kaspersky security products continue to detect and block activity linked to the group.
Microsoft Removes WMIC from Windows 11 After Years of Abuse as LOLBIN by Ransomware and Attackers
Microsoft has begun permanently removing the legacy WMIC command-line utility from Windows 11, starting with versions 24H2 and 25H2. The tool is no longer available in fresh installations, has been dropped as an optional component, and is absent from the latest beta builds. WMIC provided text-based access to Windows Management Instrumentation for querying hardware, processes, services, and security software, as well as performing administrative tasks. Although the underlying WMI technology remains untouched, Microsoft has deprecated the command shell due to its long-standing use as a LOLBIN in cyberattacks. Ransomware operators have leveraged WMIC to delete shadow copies and hinder recovery, while other attackers used it to enumerate and disable security tools or add exclusions in Microsoft Defender. Administrators are directed to migrate to PowerShell, COM API, .NET libraries, and modern scripting languages, which will require rewriting legacy automation scripts.