The criminal entities running these campaigns do not operate as isolated hobbyists. They function through organized affiliate networks operating on dark web forums. In this model, developers produce malware tools and fake landing templates, while affiliate distributors receive payouts based on the volume of stolen credentials or software installations they generate.
A single viral trend can produce thousands of dollars in illicit affiliate revenue over a 48-hour window. Threat actors purchase hundreds of aged social media accounts for fractions of a cent each, equipping them with automated posting scripts that latch onto trending hashtags. Because modern audience behavior drives immediate engagement to provocative terms, the scam achieves critical reach before platform trust and safety teams can intercede.
When law enforcement and hosting providers take down one cluster of malicious domain names, the operators point their automated redirects to fresh top-level domains within seconds. The low operational cost makes this strategy sustainable, regardless of how quickly social platforms remove individual links.
