File · HookAds · Unknown · misp-galaxy · refreshed 2026-10-06
HookAds
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- 2026-10-18todaynew CVE1 new CVE: CVE-2018-8174
Analyst brief
misp-galaxyHookAds is a malvertising campaign that purchases cheap ad space on low quality ad networks commonly used by adult web sites, online games, or blackhat seo sites. These ads will include JavaScript that redirects a visitor through a serious of decoy sites that look like pages filled with native advertisements, online games, or other low quality pages. Under the right circumstances, a visitor will silently load the Fallout exploit kit, which will try and install its malware payload.
CVEs HookAds is cited as using in a campaign
none on KEV- CVE-2018-81742026-10-17
“If the redirected user is running Internet Explorer, the Fallout Exploit Kit will attempt to exploit the Windows CVE-2018-8174 VBScript vulnerability to install the payload.”
cited as used in a campaign · named nearby · source: bleepingcomputer.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
1 sourceTrack HookAds on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.