Security researchers tracking the URLs attached to the controversy uncovered an extensive web of scam links. When users click on these circulating links, they rarely reach a functioning video host. Instead, they trigger multiple intermediate hops through domain masking networks that disguise the destination IP.
The primary destination pages employ deceptive design tactics. Some present simulated video players featuring an endless buffering wheel, accompanied by a prompt demanding that users verify their age through social login credentials. Giving in to these prompts directly surrenders session tokens and account credentials to threat actors. Other pages prompt users to allow browser notifications or download malicious APK installation files masked as private media players.
Cybersecurity teams emphasize that these campaigns harvest more than ad revenue. The malicious scripts capture browser fingerprinting data, attempt cross-site request forgery, and infect devices with background adware. Engaging with these links creates tangible personal risk for the consumer.
