Verified ads, destinations that do not match

01 · Executive summary

Shared traffic and persuasion patterns, no established common operator

CASHCLOAK LATAM is the tracking name I use at Cyber Threat Intelligence LATAM for this investigation. It is a working label, not the name of a group or an actor.

02 · Key findings

Seven findings

1. The entry point is paid, verified advertising.Google ads in the browser and in Gmail Promotions with the label “Advertiser identity verified by Google”. That verification confirms who pays for the ad, not that the offer is legitimate.
2. The declared advertisers are many and dispersed.Advertisers declared in at least six countries (United Kingdom, Cyprus, the Netherlands, Ukraine, Australia and Brazil), with ads aimed at Argentine users. This is consistent with a market of traffic buyers, not with a single operator.
3. The ad’s domain and the destination’s domain may not match.An ad that showed a women’s fashion site led to a fake investment article on another domain. This is compatible with a redirect or with cloaking; from the user’s side it is not possible to determine which of the two happened.
4. Mercado Libre is the brand most used as a lure,in at least three formats: a fake article with chat, a “personal manager” chatbot and “Mercado Pago CFD”. Sharing a brand does not show that they share an operator.
5. A site with the Balanz brand asks for the full card, including the security code.It is not Balanz. Asking for the CVC in its own form in order to “deposit” is a serious risk signal, although it could not be confirmed that cards were stolen.
6. Not everything that appears in this circuit is fraud.An “ANSES Loans Guide” landing page showed thematic content without asking for sensitive data. It is included as context, not as phishing.
7. A verified ad pointed to a generic subdomainthat does not refer to any known brand. It is published as a hunting indicator, without claiming what content it served.

03 · Scope

What this publication is and what it is not

The scope is the user experience I documented: ads displayed on one phone, information from “My Ad Center” and pages opened through that interaction. I retain the original screenshots and the SHA-256 hashes recorded in the investigation evidence archive. This report does not provide an audience measurement, a backend test or a complete infrastructure inventory.

Declared advertiser, displayed domain, landing page and conversion step are distinct roles. No responsibility is attributed to individuals, nor is advertiser control over destinations demonstrated. Google, Mercado Libre, Balanz, YPF, La Nación, ANSES and the named banks appear as platforms or used brands; their presence does not show participation in fraud.

Roles before names

I do not name or identify in any way the advertisers listed as payers, nor do I indicate what type they are; their data goes only to the platform, through the corresponding reporting channel. I refer only to their declared country, because what matters is the pattern and not who is listed as the account holder.

04 · The trust signal

What a “verified” ad proves and what it does not

The evidence records the label “Advertiser identity verified by Google” and the declared location shown when the ad was inspected. The observation concerns that disclosure, not an audit of the verification process or independent confirmation of the account holder’s identity.

The disclosure helps preserve context and report an ad, but does not establish the offer’s legitimacy or control over the destination. The report considers affiliates and intermediaries as possible explanations; it does not confirm that any such role applies to every payer.

The persuasion hypothesis is that verification, combined with a news-site design or familiar brand, can transfer confidence to an offer. This study did not measure that perception or a conversion rate. The operational distinction is to examine both the ad and the page that actually opens.

05 · The path

From attention to data

The observed verticals do not all go through the same steps, but they fit a common scheme:

1. Paid ad“Sponsored”, with verified advertiser identity.
2. Displayed domain → real destination sometimes differentThe site in the ad may not be the page that opens.
3. PersuasionFake article, well-known brand, borrowed authority, urgency.
4. ConversionChat · phone (+54) · full card with CVC.
5. Next step outside the pageCall, “bond”, “deposit”.

The arrows describe a user’s path, not a relationship between operators. That two destinations share a step does not mean they are run by the same person.

06 · Ad paths

Six verticals and a generic destination

Seen one by one, they look like isolated scams. What can be observed is that almost all of them arrived the same way: paid advertising, shown as “Sponsored” in the browser, in Gmail’s Promotions tab or on native ad networks. Some destinations ask for card data; others, a phone number; others only show content. Not all of them are fraud, and this is made clear in each case.

07 · Pattern

What they share: a repertoire, not a server

• Borrowed authority. A national newspaper, a state-owned oil company, banks, a broker, a public agency, the largest marketplace in the region.
• Verification as a shield. The “verified” ad transfers its credibility to the destination, even though it only covers the payer.
• Disproportionate promises. 450%, 150,000 pesos turned into 5,000,000 a month, 200:1 leverage.
• An upfront charge. “Bond”, “minimum deposit”, “deposit by card”.
• A conversion that leaves the page. Chat, call, form: the harm is completed in a channel the page does not show.

That repertoire is compatible with a market of templates, affiliates and traffic buyers. A common operator could not be established, and the diversity of payers and countries suggests the opposite: many actors competing for the same victims with the same tools.

08 · Level of certainty

What is proven and what is not

09 · Impact

Who it hits and where

Users. The documented material combines familiar brands, news-like presentation and investment promises. The described risk is giving data or moving toward a payment on the basis of those signals. No count of deceived people is available.

Impersonated brands. Use of their identity raises reputational and support risks. This report does not quantify complaints, brand damage or involvement by the named entities.

Banks and fintechs. Card exposure, transfers and subsequent calls are points to compare with first-party records. The investigation does not confirm charges, losses, stolen cards or a specific banking operation caused by the ads.

Advertising platforms. The observed mismatch between displayed domain and destination raises a testable question about that journey. It does not alone demonstrate cloaking, a particular bypass or what a platform reviewer saw.

10 · Indicators

Indicators of compromise (IOCs)

Seven domains, all defanged ([.]): do not visit them. To import them, replace [.] with .. first_seen is the date of my first observation (Argentina time), not the domain’s creation date.

• BLOCK destinations with observed fraudulent content. They can be blocked by FQDN.
• HUNT search DNS and proxy logs; do not block without your own analysis.

11 · Techniques

Mapping to MITRE ATT&CK

ATT&CK is used only where it represents what was observed well.

As a complement, the MITRE Fight Fraud Framework (F3) is better suited than ATT&CK Enterprise to describe financial fraud against consumers.

12 · Recommendations

What to do, by role

13 · Method and limitations

How it was done and how far it goes

Method

• Passive observation, as a user. Ads shown on a phone during two days of normal use (30 Sep and 1 Oct 2026, Argentina time), in the browser, in Gmail Promotions and on native ad networks.
• Payer source. The public information in Google’s “My Ad Center” for each ad: declared payer, location and verification status.
• Destinations. Only the pages that opened when tapping the ad, documented with screenshots kept with their cryptographic hash.
• Language of certainty. Each claim is marked as observed, assessed (with a confidence level) or not established.

Limitations

• It is a small sample: one phone, two days. It does not measure prevalence or reach.
• From the user’s side it is not possible to distinguish a redirect from cloaking, or to know what another visitor or the platform’s reviewer sees.
• There is no screenshot of the generic destination’s content, and it was not recorded which ad led to the form with the Balanz brand.
• No technical relationships between destinations were established; the template matches are moderate-confidence assessments.
• It is not known who operates the destinations, whether any of them shares an owner with another, or how many people entered their data.
• The destinations may rotate or change content after the observation.

14 · Conclusion

The entry point, not the infrastructure

The documentation supports comparison of entry points and persuasion techniques, not the consolidation of all destinations into an attributed infrastructure. Sharing an audience, brand or a template assessed as similar does not establish ownership, backend or common operator.

The “traffic market” reading is an organizing hypothesis for this sample. It neither proves that no gang exists nor identifies how many operators participated. CASHCLOAK remains the study’s tracking name, not a threat-actor identity.

When reusing the evidence, retain each case’s journey, date, classification and unresolved questions. Observations on 30 September and 1 October do not certify destination activity after those dates. Connections not demonstrated by the report are not combined.

15 · Coordinated disclosure

Coordinated disclosure

16 · Citation and license

How to cite

@techreport{laterra2026cashcloak,
  author      = {La Terra, Ezequiel Jorge},
  title       = {{CASHCLOAK LATAM}: verified ads and investment- and card-fraud
                 destinations aimed at Argentine users},
  institution = {Cyber Threat Intelligence LATAM},
  number      = {CTI-LATAM-2026-001},
  year        = {2026},
  note        = {Public edition v2, TLP:CLEAR},
  url         = {https://cyberthreatintelligence.lat/en/report/cashcloak-latam/},
}

License

Text and data under Creative Commons Attribution 4.0 International (CC BY 4.0). They may be reused and adapted, including for commercial purposes, with attribution.

Notice

This publication describes observations made as a user and analytical assessments marked as such. It does not attribute responsibility to individuals or companies. The declared advertisers are mentioned only by their country and are not presumed responsible for the destinations. The brands and platforms named are victims of impersonation or providers of a service, not parties. Corrections are published, with their date, in the corrections log.