PropellerAds: Why Modern Malware Delivery Starts Before the Payload

By Farukh Rakhimov, Head of Compliance, Data Protection, and Information Security at AdTech Holding

In March 2026, Google Threat Intelligence Group (GTIG) disclosed Coruna, an iOS exploit kit with five exploit chains and 23 exploits covering iOS 13.0 through 17.2.1.

The most instructive part of the disclosure is what happened before the exploit got any chance to run.

Coruna was amazingly picky about visitors. A JavaScript fingerprinting module checked whether the visitor was a real device, which iPhone model it was and which iOS version it ran. Only then did the framework fire a matching exploit.

Researchers, scanners, Lockdown Mode devices and private browsing sessions were shown the door.

For a defender, the payload is where the investigation starts. For the operator, it is the end of the assembly line: by then, traffic has already been acquired, routed and qualified, mostly in plain view.

At PropellerAds, we see that upstream layer from the advertising side, including through ADEX, our traffic-quality and anti-fraud system.

A malware campaign is a delivery system

A modern malware campaign makes a lot more sense if you look at it as a delivery system. It usually has five parts:

• Acquisition: a paid ad, a search result, a compromised site, a messenger link.
• Routing: redirectors and traffic distribution systems (TDS) that decide where each visitor goes next.
• Trusted infrastructure: CDNs, code repositories and file-sharing services that help malicious traffic blend into the furniture well.
• Visitor qualification: fingerprinting that decides who gets the payload and who gets a decoy.
• Persuasion: a fake download page, a fake virus alert, or a chat in WhatsApp or Telegram.

In June 2026, Check Point Research described fake open-source download sites that loaded a staging script from Amazon CloudFront and handed clicks to a TDS.

The TDS scripts were in place by December 2025; malware distribution through them began in January 2026. In other words, the pipes were already in place weeks before anyone turned on the malware tap.

The chains were always long. Now they are selective.

Long redirect chains are stale news. A USENIX Security study back from 2008 found that in half of the cases where malware was delivered through ads, the visitor passed more than six redirects before reaching the payload.

What has changed is selectivity, and Coruna takes it to the extreme. A mismatched exploit crashes Safari, and a chain delivered to a researcher gets patched. If a reviewer visits once, from one profile, they see exactly the version the attacker wanted them to see. 

What an advertising platform sees, and when

An ad platform cannot see an infected device, but it sees what endpoint tools never do, in three windows:

• At submission: account signals, the declared destination, domain history, and reuse of domains, scripts or hosting from blocked campaigns.
• At moderation: the full redirect path, scripts and hidden iframes on the landing page, and whether the page answers different visitor profiles differently.
• After launch: real traffic, destination changes after approval, and abuse reports.

Visibility also has edges. In one ADEX case, the ad itself ended at a Google search page. The critical hop happened only after the user clicked the first result, pushing the next stage outside the ad’s direct click path.

That is exactly why destination verification and journey reconstruction are not the same thing. 

None of this requires catching the payload red-handed. A page that loads a hidden iframe, checks the OS version and calls a version-specific script is suspicious before anyone retrieves the exploit.

One operator, fifty faces

Everything above about Coruna comes from GTIG’s research. What follows is ADEX’s own investigation, and it concerns the delivery method, not the exploit kit: ADEX found ad campaigns built on the same qualify-first logic, which does not mean Coruna itself was delivered through them.

The ADEX team identified approximately 50 advertiser accounts linked to campaigns that used the similar delivery setup behind landing pages with nothing in common: a social offer, a finance page, changing formats and verticals.

The findings were passed to the platforms using ADEX, whose teams reviewed the accounts and took action.

Underneath, the chain was identical. A hidden iframe checked the OS version. An orchestrator then filtered out bots and crawlers, checked the IP, and served a script for that iOS version as an ordinary-looking .min.js file.

That sequence is what linked the accounts. Nothing on the pages themselves connected them: themes, brands, verticals and formats all differed. Only the delivery behavior repeated.

Creative by creative, these looked like unrelated advertisers. By delivery behavior, they looked like one operator.

The cloaking setup takes weeks to build; a landing page takes a day, so operators reuse the first and refresh the second.

The analysis gave ADEX metrics that now flag the pattern during moderation, before a campaign reaches traffic. A new campaign that reproduces the delivery pattern is flagged whatever its landing page looks like.

What changed in 2026

ADEX’s Trust & Safety review, based on moderation data from eight ad platforms for January to September 2026, shows the same shift at scale.

Indicator	Earlier period	Q3 2026
Cloaking, share of suspensions	~75% (full year 2025)	~45%
Malicious iOS scripts, share of suspensions	not a separate category before Q3	~20%
Infected domains, share of rejections	~1/3 (Q1 2026)	~1/3

Source: ADEX, State of Ad Fraud 2026: Trust & Safety Report

Baseline periods differ by row, so the table shows a changing mix of reasons, not a like-for-like trend. Malicious iOS scripts became a separate category only in Q3: ~20% is their share that quarter, not measured growth.

Cloaking is still the top suspension reason, but it now shares the list with device-specific scripts and messenger phishing, where persuasion moves into a chat reviewers cannot follow.

AI speeds up the cheap layer: in the cases ADEX reviewed, a rejected campaign could return rebuilt within hours. The delivery infrastructure changes far more slowly, which makes it the more reliable thing to track.

From “what ran” to “how the victim arrived”

Endpoint detection remains necessary, but it starts at the last step of the chain and treats incidents separately, even when one delivery path sits behind several.

Level	What the team does	Question it answers	Blind spot
1. Payload-centric	Endpoint alerts, hashes, IOC blocklists	What ran?	How the victim got there
2. Path reconstruction	Rebuilds the redirect chain from DNS, proxy and browser data after an incident	Where did it come from?	Reactive; one chain at a time
3. Delivery-aware	Clusters incidents by delivery traits; rescans from varied profiles	What else uses this path?	No view of traffic sources
4. Upstream-connected	Shares path-level signals with ad platforms and traffic sources	Who is being sent down this path now?	—

Moving up does not require a new product, only a few changes in practice:

• Record the path, not only the file. The redirect chain is often the only artifact shared by incidents that look unrelated.
• Treat a single clean crawl as inconclusive. Revisit suspicious paths from different device and network profiles, and follow the journey beyond the declared destination. A clean first hop may simply hand the user off to the next stage. 
• Cluster by delivery, not content. Redirect shape, iframe behavior, script hashes and hosting survive a creative refresh; page themes do not.
• Keep legacy devices in view. Apple backported Coruna-relevant fixes to iOS 15.8.7 in March 2026, but unpatched devices stay exposed longest. 
• Report the full path to the source. An ad platform can block an operator’s next fifty campaigns only if it sees what connects them.

The takeaway

The layer that decides which visitor is real and which is a reviewer is the same engineering whether it protects an exploit chain or a scam page. “What ran?” remains a necessary question.

Teams that also ask “how did the victim arrive?” see the operator earlier and connect incidents that otherwise look unrelated.

Methodology

ADEX figures come from the State of Ad Fraud 2026: Trust & Safety Report, based on aggregated moderation data from ad platforms using ADEX, January to September 2026.

Percentages describe the composition of rejected or suspended campaigns in that dataset, not industry-wide prevalence.

Author:

Farukh Rakhimov — Head of Compliance, Data Protection, and Information Security at AdTech Holding, the parent company of ADEX. Over 8 years he has built and led compliance, data protection, and information security across the group. His work spans GDPR governance, KYC and AML frameworks, financial risk assessment, and ISO 27001 certification for the group’s flagship platforms. A PhD candidate at the University of Cyprus, Farukh brings a practical, no-nonsense take on data protection — showing how businesses can turn regulatory pressure into real trust and treat compliance as a competitive edge, not a checkbox.

The post PropellerAds: Why Modern Malware Delivery Starts Before the Payload appeared first on Cyber Security News.