The Millionaire Adware, or how an adware kit makes money off your clicks and data

What is the Millionaire Adware?

The Millionaire Adware, the name our Threat Intelligence team gave it after analyzing the operation, is a sophisticated adware campaign engineered to generate as much revenue for its operators as possible.

Adware, short for advertising-supported software, is software that displays unwanted ads on your device. It can hijack your browser and flood the screen with advertisements as well as make normal browsing difficult. Adware is generally considered less dangerous than malware such as worms or trojans, but you still don’t want to take it lightly.

Now, the inclusion of some adware is disclosed by whatever program that ships it, and so that adware is installed with user consent. Malicious adware, which most adware is, installs or activates without consent, with ad delivery designed to steal personal data and funnel your device into further malware infections. The Millionaire Adware falls into that second category.

How the Millionaire Adware works

The Millionaire Adware works through a JavaScript (JS) tag written directly into the code of an infected page. It is marked internally by a distinct identifying attribute called “data-admpid.” Upon startup (as soon as that JS tag loads), a self-executing function checks if the visitor is a real person or a search engine crawler indexing the page for search results.

If the script recognizes a crawler, it withholds its ad behavior entirely, so the infected site continues to appear clean to search indexes. 

But if and when the script recognizes the visitor as human, it then triggers the kit’s core component, what researchers call AdManager. AdManager orchestrates the adware’s full lifecycle. It collects data about the visitor’s device, requests configuration instructions from a remote server, initializes its ad formats, and begins tracking behavior for as long as the visitor stays on the page.

Bait scripts and proxy bypass

It’s not a given that an average ad blocker will protect you from the Millionaire Adware because the script implements dual-level ad blocker detection — or, put another way, two separate checks (baits, as we call them) that detect an ad blocker and evade it. The first check is when the adware plants invisible HTML elements using the class names ad blockers typically target (such as “adsbygoogle” and “doubleclick”), then checks if they get zeroed out. The second check is when it attempts to load a bait script. If the load fails, then the adware assumes a blocker is active.

And when ad blocking is detected, the script implements a proxy delivery system and uses a domain generation algorithm (DGA) to create new hashed domains on a rolling basis. It’s a tried-and-tested technique for getting around static blocklists. The domains are seeded using the current date and rotate every 24 hours, which doesn’t leave blocklists with much of a shelf life. Even a blocklist that’s only a day old won’t be able to block the domains being used today.

Cloaking and obfuscation

Another thing we see is the use of cloaking and obfuscation (deception techniques) to conceal how parts of Millionaire Adware operate.

That initial bot-or-human check at startup is deliberate engineering. To throw crawlers off, the Millionaire Adware compares the visitor’s user agent against a list of more than 60 known bots (such as Googlebot, Bingbot, YandexBot, AdsBot, and facebookexternalhit) and blocks ads for any match. It also fetches a separate configuration to serve different content based on server-side conditions.

And when I look at the code, it’s clear to me that it’s been written to resist analysis. It’s minified, and its modules carry numbers instead of names, so anyone trying to reverse engineer it would have to go back to square one. 

You could even say the adware kit reports on itself. Runtime errors go to a self-hosted Sentry instance, giving operators a window into how the adware is running on infected devices. Known errors, meanwhile, are filtered out to strip the logs of entries that might otherwise raise eyebrows.

This is the kind of housekeeping you pretty much only see in a maintained product.

What data does the Millionaire Adware collect?

The list is long. Device-side, the Millionaire Adware kit picks up GPU model, CPU core count, RAM, screen resolution and color depth, operating system and browser version, installed fonts and plugins, language settings, timezone, and available storage. It also flags incognito or private browsing and checks for an accelerometer and gyroscope, the same sensors your phone uses to know which way it’s facing.

Then there’s the data tied to how a visitor, so to speak, behaves. Referral source, social media origin, page keywords, UTM parameters, scroll depth, and click activity all get logged, dead clicks  — the ones that land on page elements with no functionality — included. The adware kit also checks for crypto wallet tools like MetaMask and tries to work out whether a visitor is signed in to a Google or YouTube account.

Turning data into a sellable profile

The Millionaire Adware collects your data for one thing, and it is to mold a profile of you that can be sold. Basically, it turns you into the product.

The way Millionaire Adware does this, or at least tries to, is by pulling audience segment IDs from a remote server. It then sorts visitors into categories that advertisers can target directly, much like legitimate ad platforms let you target “sports fans” or “high-income shoppers” or “gamers,” except here the categories are built without anyone’s knowledge or consent.

There’s another piece to this too. The script inserts invisible tracking pixels (one-pixel iframes you’d never notice) that connect to partner ad networks and pass along the visitor’s ID. This technique is known as cookie syncing, and it allows different platforms to recognize that they’re looking at the same person (you), even when they otherwise wouldn’t have a way to connect the dots.

So whatever profile is built on one infected site isn’t necessarily confined to it. Once the visitor’s ID is synced, that profile can follow them into whatever network is now able to tie its own data back to the same person.

What makes the Millionaire Adware dangerous?

What makes the Millionaire Adware so dangerous is the fact that it’s a full ad-delivery system where virtually any click on a page infected with this adware can trigger a redirect, or technically a popunder, which is a new window that opens behind the one you’re using.

Click or tap almost anywhere on the page (even on non-advertising elements), and that action will trigger the adware to open a tab pointed at a scam site, a phishing page, a malware download, or a prompt asking you to subscribe to push notifications.

Don’t overlook the last part. Subscribing, even by accident, hands the infected site and perpetrators behind it a channel to send you messages with malicious intent (for them — to make money off you) after you’ve closed the tab and gone about your day. Which means the operators get more than one shot at you.

But popunders aren’t the only format in play here. The Millionaire Adware also manages banner ads (some as small as a single pixel and used purely for tracking), native ads, in-page push messages, full-screen interstitials, and video ads. Between all of these formats, operators have plenty of ways to put an ad or a redirect in front of you.

The Millionaire Adware’s operators have three revenue streams. They resell the profile the adware kit builds from your activity to third parties, they use the ads as a means to drive traffic to scam, phishing, and malware pages, and they still pull in direct ad revenue from every forced click and pop-up along the way.

So that’s what’s really going on here and why the Millionaire Adware is so dangerous. Not because it serves ads and the ads are a nuisance but because a single infected page can work three angles on its visitors at the same time. Now stretch that out over months and across hundreds of thousands of users, and you start to see the scale of it.

The sites most likely to have it

The Millionaire Adware has a confirmed presence on at least 50,000 active websites. Most are classed as high risk and include illegal streaming sites, torrent portals, underground forums, and adult sites.

These sites run on ad inventory that mainstream ad networks won’t even think about touching. Piracy and adult content get rejected by reputable exchanges, so site operators make do with lower-tier ad networks with far less vetting, and kits like the Millionaire Adware get distributed through exactly that pipeline.

Some operators know full well what type of ad-delivery systems they allow on their pages. Others just plug in a script from a network that pays well and don’t ask further questions.

Every month, hundreds of thousands of NordVPN users are targeted by infection attempts tied to this kit, on exactly the sites classed above.

How to protect yourself from the Millionaire Adware

To protect yourself, start with the sites you visit. Pirated streaming sites, torrent portals, underground forums, and adult sites are the primary distribution points for this adware kit, so avoiding them cuts off your exposure at the source. It’s the single most effective step you can take since every other step here is about limiting damage in case you end up on an infected page anyway.

Should you land on an infected page, an ad and tracker blocker stacks the odds in your favor. But only if you get a good ad blocker from a reputable provider. A basic blocker that you can find for free on the internet likely won’t be able to do much here, since the Millionaire Adware is designed specifically to detect and route around blockers. Look for ad and tracker blockers that are actively maintained and regularly updated with new filter lists. But even then, don’t expect them to stop every redirect. What they can do is block many of the ad formats and tracking scripts the kit relies on to operate.

Be careful with browser notification prompts too. If a site you don’t recognize or trust asks for permission to send you notifications, deny it. Accepting one hands that site continual access to your device after you’ve closed the tab.

Also, it’s important that you keep your browser and security software current. Updated browsers patch known vulnerabilities the Millionaire Adware kit and others like it try to exploit. 

One piece of information is missing from this picture —  a digital security solution. And you happen to already be in the right place to find one. NordVPN’s next-gen antivirus can block access to malicious sites and phishing pages, which would cut off many of this kit’s redirects at the destination even if you’ve already clicked on the page. It can also scan downloading files for malware and block trackers and intrusive ads. 

So if you don’t have a solid security setup in place, or you’re looking to upgrade, NordVPN is built for exactly this kind of threat. You can get the full details in the next-gen antivirus whitepaper.

What I leave you with

Don’t mistake the Millionaire Adware for just a rogue ad script. It’s an operation, deliberately, and dare I say competently, designed and maintained by bad actors who profit twice over, once from every forced click, and again from selling the profile they build out of your data.

Every “free” stream you watch, every piece of pirated software you download, and every torrent portal or underground forum you wander into is another opportunity to run into Millionaire Adware. 

If you avoid that corner of the internet, then the chances of you being served the Millionaire Adware are slim. Every now and then, however, you can still end up on the wrong page even if you did everything right, which is why the rest of my recommendations (like using a trusted digital security solution) should be thought of as insurance. You hope you never need them, but you’ll be glad you made the call to prepare.