Topic

Pay-Per-Install Networks

Underground distribution businesses in which one operator infects machines at scale and sells install access to multiple malware buyers, who each run their own malware through the shared dropper.

Current clusters

security1 publisher

Unit 42 pulled a two-year pay-per-install marketplace out of two dismissible adware tickets

Unit 42's CL-CRI-1171 sold installs to other criminals for at least two years, funneling gamers through YouTube and professionals through poisoned search results, while its loader stayed unnamed because nobody escalated it.

Publishers:unit42.paloaltonetworks.com

Reality

Evidence70
Adoption58
Hype gap+14
Incentives74
Confidence60