Distributed Crawler Poses as Human Visitor to Evade Analytics and Ad Filters
A site owner watching traffic graphs climb while advertising revenue stayed flat would normally celebrate algorithmic success. In this case the numbers told a different story: Google Analytics recorded new sessions, the server performed full TLS handshakes and dynamic page generation, yet no corresponding ad impressions were billed.
The discrepancy arises because GA4 accepts events via the Measurement Protocol, a server-to-server channel originally intended for offline interactions. A crawler that crafts the correct payload can register a session without ever rendering advertisements or executing the full browser resource chain of CSS, JavaScript, fonts and favicons.
Operators of a network of unrelated sites noticed the same subtle footprint on each property. Individual requests carried ordinary modern browser strings, arrived from search-engine referrers, and followed internal links at a human-like pace. Only when events were aggregated into a cross-site graph did the coordinated pattern emerge: dozens of IP addresses replaying nearly identical sequences while rotating User-Agent strings and never loading supporting page assets.
One particularly convincing candidate, masked as 203.0.113.0/24, produced roughly one hundred events over eight days. Its profile included search transitions, internal navigation, and a modest set of static resources. Raw logs, however, showed that almost half the requests openly declared themselves with the string “crawler” and that the supposed resources were exclusively images returning 404 responses without Referer headers.
Further examination of referrer data exposed additional contradictions. The same addresses claimed simultaneous arrivals from Google, Yandex, Bing and Baidu within minutes, an impossible sequence for any single human reader. Internal-link Referers were fabricated to simulate article-to-article reading, yet no stylesheets, scripts or actual page images were ever requested.
The investigation relied on a continuously updated graph whose vertices represented addresses, network blocks, browser masks and requested resources. Edges captured temporal and causal relationships, allowing analysts to test whether short, seemingly natural sessions on separate sites actually belonged to the same automated actor. GPU-accelerated processing made parallel comparison of hundreds of candidate biographies feasible.
The episode illustrates that server logs remain the only immutable record when analytics platforms and advertising systems can be fed synthetic events. By focusing on missing resource chains and contradictory origin stories rather than any single IP or country, defenders can surface distributed crawlers that have studied human browsing patterns in detail.
Related articles
SC Malware on WordPress Restores Deleted Backdoors in Seconds via Eight Persistence Points
Researchers at Sucuri have analyzed the SC malware targeting WordPress sites, which rapidly restores any removed backdoor components through a minimum of eight interconnected persistence mechanisms. The infection hides across PHP configuration settings, hidden loaders, theme files, and plugins, with some elements executing before standard WordPress plugins load. Copies of the malicious code are also stored in the database and System V shared memory on supported servers, allowing full reinfection from surviving sources after file cleanup. The backdoor evades plugin listings, gathers site and administrator session data, deploys additional PHP code, and disables security plugins while injecting JavaScript for payment data theft in online stores. Command-and-control occurs through public Ethereum RPC gateways and smart contracts with multiple fallback channels. Sucuri warns that PHP caching of the loader directive can crash request handling if the referenced file is deleted without prior preparation, and recommends a sequenced cleanup process.
RATHat Trojan Leverages Google Gemini to Infect and Control Android Devices
The banking trojan RATHat has begun using Google Gemini as an assistant to infect Android smartphones and maintain persistence. Researchers at Cleafy report that the malware first disguises itself as a legitimate application and tricks users into granting Accessibility permissions. Once inside, RATHat activates wireless debugging, connects via ADB, and deploys a separate Go-based service running with system-level privileges. Gemini helps the trojan interpret unfamiliar Android interfaces across different versions, languages, and manufacturer skins by analyzing UI structures and suggesting the correct taps. On the attacker side, the same model processes intercepted SMS messages, evaluates bank balances, and ranks compromised devices by financial value. Since April, Cleafy has observed nearly 100 deployments of the command-and-control infrastructure, pointing to a possible malware-as-a-service model. Removing the original APK is insufficient because the Go service survives independently until reboot and can reinstall the dropped payload.
Mimbrob Malware Uses Fake Dronner App to Target Russian Military and Industrial Firms
Researchers at F6 have identified a new malware campaign dubbed Mimbrob that leverages a fake drone-tracking application called Dronner. The lure promises data on heavy Baba Yaga drones and remote mining locations but instead deploys malicious payloads aimed primarily at Russian military personnel near the front line. The malware checks system language, keyboard layouts, and interface preferences, remaining dormant or terminating if Russian or certain CIS and Romanian languages are absent. Since April 2026 the same operators have conducted phishing campaigns against Russian industrial and IT companies using FBULoader disguised as a Yandex Browser update and the RAT-Go remote access trojan. The attackers register lookalike domains of legitimate Russian enterprises to deliver fake metrology notices and court documents. While espionage appears the most probable objective, researchers have not yet obtained the final payload and therefore refrain from definitive attribution.
Group-IB Discovers RemControl Android Banking Trojan Using Dynamic Overlay Attacks to Steal Banking PINs
Group-IB has identified a new Android banking trojan named RemControl with samples dating back to July 2026. The malware targets more than 30 financial institutions across Europe, the Middle East, and Canada, with Italy and France as primary focus areas. RemControl employs an overlay technique that displays a full-screen phishing replica of the legitimate banking app when the victim launches the real application, capturing PINs, access codes, and card details before seamlessly returning control to the authentic app. Phishing screens are not bundled in the APK but are fetched dynamically from operator-controlled servers reachable via Telegram channels, allowing rapid target changes without reinfection. Distribution relies on fake Google Play listing pages that mimic a streaming application, with geo-targeted delivery for Italian visitors. The trojan requests VPN permissions to block Play Store traffic and bypass real-time security checks, followed by accessibility service access that enables screen reading, keystroke logging, remote taps, and unlock pattern reconstruction.