Brand impersonation now drives initial access, using fake sites and apps to deliver malware, making rapid takedowns essential to disrupt attacks.
Attackers recently poisoned more than 700 websites, including sites run by Harvard, Oxford, and DuckDuckGo.
They used a fake Cloudflare page to trick visitors into running a ClickFix attack that installed malware. Researchers tracing the incident found the same injected code running across hundreds of unrelated sites, all feeding shared attacker infrastructure.
That Harvard and Oxford can get turned into malware delivery platforms is concerning. That two rival criminal groups were fighting each other for control of the same hijacked sites is cause for immediate action.
Whether you’re a university, online retailer, financial institution, or anything in between, brand impersonation is no longer merely a reputational irritation. It’s attacker infrastructure, and you need to act accordingly.
Brand impersonation is now a delivery mechanism
For most of its history, brand impersonation sat with legal as a trademark problem. What changed is what attackers do with it.
An attacker no longer needs to break into an organization when they can position themselves between a trusted brand and its customers. Phishing sites, fake apps, fraudulent social media accounts, or malicious paid ads all point to the brand itself becoming part of the attack chain.
As far back as 2022, the FBI warned of search-ad impersonation. This attack technique involves cybercriminals buying ads that display in search engine results that closely resemble a real business, so the fraudulent listing ranks above the legitimate one. Customers click the top result, land on a spoofed domain, and either download malware or input their credentials.
Fake apps and cloned shops also follow the same principle, while executive impersonation extends it to a single person’s name and likeness. In every case, attackers pose as something or someone users already trust. That means they don’t actually have to breach anything. Essentially, the brand does the social engineering for them.
These emerging — or, if we’re honest with ourselves, emerged — techniques have led to a steady rise in phishing attacks. The Anti-Phishing Working Group (APWG) recorded 971,181 phishing attacks in the first quarter of 2026, a 13.8% increase over the previous quarter, and impersonation-driven abuse is a growing share of that total rather than a static slice.
Why blocking feels like winning (but isn’t)
One of the big problems with merely blocking phishing URLs is that it feels like you’re doing something. It’s instant gratification at its worst — teams check a box, metrics look green, and the immediate crisis disappears.
Local blocking (whether via firewalls, secure email gateways (SEGs), or DNS-layer blocklists) stops a URL from resolving inside the corporate perimeter, but leaves the broader threat untouched. But that means the domain stays live for every user outside that specific filter.
Even worse, attackers can redeploy the same kit with a new domain, a swapped hosting provider, or a single-character variation, so the campaign continues largely unhindered.
These attack techniques let cybercriminals scale impersonation to previously unimaginable levels. A single phishing kit becomes dozens of near-identical deployments, and one fraudulent account becomes a cluster of linked profiles. Blocking individual URLs treats each deployment as a fresh incident, when the attacker is running the same infrastructure repeatedly.
As a result, organizations are left playing a game of whack-a-mole. They spend enormous energy knocking down individual deployments, when what they should really be doing is unplugging the machine.
The ownership vacuum
Responsibility for brand impersonation tends to belong to three different teams.
Legal owns the trademarks and can pursue enforcement, but their processes move on a slow timeline. Marketing teams own the channels where impersonation happens (like social platforms or app stores) but can’t pursue takedowns. SOCs track alerts generated by activity inside the network, but impersonation targeting customers remains invisible to them.
The problem is that no one really owns takedowns, so it becomes ad hoc. Whoever notices the impersonation attempt files a report through whatever abuse channel the hosting provider, registrar, or ad platform happens to offer. And each of them will have their own evidence requirements and response timeline.
That fragmentation creates a bottleneck that prevents brand protection from keeping pace with automated attackers. Although an analyst can identifya lookalike domain fast, getting it removed can be achingly slow and complicated.
Analysts must navigate a reporting form for every registrar, host, and platform involved, with no guarantee that any of them prioritizes the request. Meanwhile, an attacker running automated tooling spins up new infrastructure faster than any manual process can take down the old.
Treat brand impersonation like C2, measure it like an SLA
The fix is to treat brand impersonation infrastructure like a SOC would treat C2 infrastructure: tracking, correlating, and removing attacker infrastructure on a measured timeline.
That means analyzing the attacker’s operational patterns. Shared ASN registrations, repeated hosting providers and reused SSL certificate issuers link campaigns that look unrelated at the URL level but come from the same source.
Once the SOC has mapped that infrastructure, the response can move from passive legal correspondence to something closer to an enforced service level agreement (SLA), with a defined target for time between detection and takedown, and a way to measure whether they’re meeting that target. You can read Netcraft’s Field Guide to Brand Protection to learn more about the operational details behind that capability.
Reframing this problem also brings in a better metric than just alert volume: detection-to-takedown time and infrastructure recurrence rate. They measure whether teams are actually disrupting anything, which matters when the same kit keeps appearing under a new domain.
Progress against brand impersonation comes from disrupting the infrastructure behind it, and that requires someone to own the work. Assign it to a specific function, attach detection-to-takedown time and recurrence rate as the measures, and hold the process to them.
About the Author: Josh is a Content writer at Bora. He graduated with a degree in Journalism in 2021 and has a background in cybersecurity PR. He’s written on a wide range of topics, from AI to Zero Trust, and is particularly interested in the impacts of cybersecurity on the wider economy.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, brand impersonation)
