Hundreds of thousands of users hunting for free movies, games or music each month now face a hidden danger. NordVPN’s researchers have mapped out an adware operation planted across at least 50,000 active websites. The campaign turns everyday visits to illegal streaming portals, torrent indexes, underground forums and adult destinations into opportunities for invasive tracking and malware delivery.
The discovery comes from the company’s Threat Intelligence team. It reveals scripts that do far more than show annoying banners. These programs build detailed device fingerprints. They log CPU core counts, available RAM, operating system versions, installed browser plugins. They scan for crypto wallets such as MetaMask. They even check YouTube login status through favicon tricks and capture motion data from accelerometers and gyroscopes on mobile devices.
But the real trouble starts when users interact with the page. Click anywhere that isn’t an ad. The script springs into action. It redirects browsers toward phishing pages or sites pushing additional malware. Push notification traps appear without warning. The system detects ad blockers and quietly switches to a backup domain rotation scheme. It generates three fresh domains daily under the internal label “adblock-proxy-super-secret.” That name alone hints at the effort spent dodging blocklists.
The operators also hide their tracks from search engine crawlers. Legitimate visitors see one experience. Bots see another. Such evasion tactics suggest a professional outfit that understands how threat researchers and security firms hunt for malicious infrastructure.
TechRadar first reported the findings hours after NordVPN shared them. Every month, hundreds of thousands of NordVPN customers alone trigger alerts tied to this exact adware kit. The total victim pool across all users likely runs much higher. And the numbers keep climbing.
Marijus Briedis, CTO at NordVPN, put the business model in blunt terms. “If you’re not paying for a product, you are often the product.” He added that the campaign “shows how criminals turn user attention, data, and habits into revenue at industrial scale.”
The operation fits a larger pattern. Piracy sites have long served as fertile ground for malicious ads. Earlier studies showed consumers face dramatically higher infection risks on such platforms. A 2025 report from the Alliance for Creativity and Entertainment found users up to 65 times more likely to encounter malware on piracy services than on legitimate sites. Streaming piracy, peer-to-peer networks and scam portals carried the heaviest risks.
Similar malvertising incidents continue to surface. In early 2025, Microsoft detailed how ads on two pirated video streaming domains redirected nearly one million devices toward info-stealers hosted on GitHub, Discord and Dropbox. The PCMag coverage highlighted how even enterprise networks fell victim through these consumer-facing traps.
NordVPN itself has warned repeatedly about related threats. Its researchers detailed GTA VI-themed malware campaigns in May and June 2026 that used fake game repacks, Android adware disguised as betas, and credential-harvesting pages. Those attacks targeted platforms where the game does not yet exist. The Notebookcheck article on the topic noted how the final command servers had histories of distributing banking trojans, ransomware and other adware families.
So what makes this latest campaign stand out? Its persistence and depth of data collection. Most adware stops at basic profiling. This one assembles enough signals to track users across sessions and devices with high confidence. Motion sensors alone can reveal whether someone sits at a desk or walks while browsing. Combined with hardware fingerprints and wallet detection, the profiles become valuable commodities on underground markets.
Redirects triggered by non-ad clicks represent another escalation. Traditional malvertising often relies on users clicking the bad ad. Here the trap activates on normal page interaction. That raises the success rate. It also makes the threat harder to avoid without leaving the site entirely.
Ad blocker evasion through daily domain changes adds operational maturity. Many adblock lists update within hours or days. Rotating three new domains each day keeps the payload one step ahead. The bot-hiding mechanism further complicates analysis by security firms that rely on automated crawling.
Industry observers note that such sophistication rarely appears in amateur operations. The infrastructure points to organized actors who treat ad fraud and data theft as a core revenue stream. Revenue flows from displayed ads, redirected traffic to affiliate scams, stolen credentials and sales of device profiles. All of it extracted from people who simply wanted to watch something without paying.
Briedis’s warning carries weight. When users become the product, their data funds the next round of attacks. The cycle rewards scale. More infected sites mean more victims. More victims mean richer profiles and higher payouts.
Defenses exist. Yet many users ignore them. Avoid piracy sites entirely. The risk outweighs any short-term savings. When that choice feels impossible, deploy strong ad and tracker blockers. Refuse all push notification requests from unknown domains. Keep operating systems, browsers and plugins current. These steps reduce exposure even if they do not eliminate it.
NordVPN’s own Threat Protection Pro feature has blocked billions of ads, trackers and malicious connections in recent periods, according to company data shared with reviewers. Independent tests from AV-Comparatives in 2026 gave the company’s anti-phishing tools a 96 percent detection rate with zero false positives on legitimate sites.
The broader lesson stretches beyond any single campaign. The advertising technology stack that powers much of the free internet contains cracks large enough for determined attackers to exploit at scale. Pirate sites simply offer the perfect anonymous, high-traffic environment for testing new techniques before they migrate to more mainstream properties.
Security teams at VPN providers, browser makers and operating system vendors now race to catalog these evasion methods. Domain rotation lists grow longer. Fingerprinting defenses improve. But the attackers adapt faster than many expected. New variants appear weeks after old ones get disrupted.
For security professionals monitoring enterprise networks, the implications are clear. Employees who browse piracy sites from company devices create direct pathways for data exfiltration and ransomware entry. Device profiles that include corporate laptop hardware details become especially valuable. Motion data might even reveal office layouts or user habits.
Consumer users fare little better. A compromised home device can lead to banking theft, identity fraud or ransomware demands. The adware’s crypto wallet detection suggests attackers specifically hunt for users likely to hold digital assets.
The campaign’s monthly encounter rate among NordVPN customers alone signals how common these sites remain. Hundreds of thousands of attempts per month. From one vendor’s user base. Multiply across the entire internet population and the numbers become staggering.
Yet awareness still lags. Many visitors assume that as long as they avoid downloads, they stay safe. The reality proves otherwise. Drive-by techniques, clever redirects and persistent tracking require no user consent beyond the initial visit.
Legal pressures on piracy sites continue to mount. Courts in Spain recently ordered VPN providers including NordVPN to block specific illegal streaming domains. Such measures rarely solve the underlying problem. New domains and CDNs appear quickly. The content migrates. The adware operators simply follow the traffic.
Ultimately the discovery serves as another data point in a long-running story. Free content carries hidden costs. Those costs now include detailed surveillance, identity risk and potential financial loss. The industrial-scale operation uncovered by NordVPN researchers demonstrates how professional the threat has become.
Users who continue visiting these sites do so with full knowledge of the gamble. The house, in this case, holds every advantage. Sophisticated scripts. Rapid infrastructure rotation. Deep device profiling. And a steady stream of victims who believe they can outsmart the system.
They rarely do.
WebProNews is an iEntry Publication