Traffer
The distribution worker of the stealer economy: drives victims to infected downloads via malvertising, fake installers, cracked software and phishing. Organized into teams with quotas and payout shares.
Why it matters to you
Traffer team chatter is a leading indicator. The lures they brag about today are the infections you triage next week.
Where we meet it
Traffer teams recruit and boast in the open, because they are hiring. The lure themes they trade in, whether a cracked design tool, a game cheat or a fake browser update, show up in our collection days before the resulting logs do.
Connected terms
Stealer log
The complete output of an infostealer infection: every saved browser password, session cookie, autofill record and crypto-wallet file from one victim machine, zipped into a single bundle.
Cloud of logs
A subscription Telegram channel that pours out fresh stealer logs daily to paying members. Bulk access to victims, sold like a streaming service.
Crypt / FUD
Crypting is the service of repacking malware until antivirus engines stop recognizing it. FUD, "fully undetectable", is the advertised result, sold with a guarantee and re-crypts included.
Malvertising
Buying advertising to deliver the lure: a paid result above the real one, pointing at a page that looks like the software the visitor searched for. Distribution with a budget and a targeting console.
ClickFix
A lure that tells the visitor the page is broken and asks them to fix it: copy this, press these keys, paste, run. The victim performs the delivery by hand, so nothing was downloaded and nothing was blocked.
Read elsewhere
Where this term stops being vocabulary
Dragnet is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the trade
Access listing
The IAB's ad format: industry, country, revenue, access level and price. Everything except the victim's name, which is disclosed to serious buyers in private.
Bot shop
A marketplace that sells the output of one infected machine as a single unit: its cookies, saved passwords, browser fingerprint and time zone, packaged so a buyer can load the lot into an antidetect browser and resume the victim's sessions.
Carding
The trade in stolen payment card data and the craft of turning it into goods: testing cards, choosing merchants, shipping to reshippers. An economy with its own schools, slang and reputations.
Cashout
The last mile: turning stolen access, cards or balances into money the criminal keeps. Gift cards, crypto, mule accounts, reshipping, each with its own fee and its own specialists.