Why do attackers use malvertising and short-lived domains for identity phishing campaigns?

Malvertising helps attackers bypass email security because the lure is delivered outside mail filters and reputation checks. Short-lived domains are cheap to register, easy to rotate, and often look more legitimate than obvious throwaway domains. That combination makes attacks harder to block centrally and gives users less time to recognize a suspicious login page before the campaign is replaced.

Why Attackers Pair Malvertising with Disposable Infrastructure

Identity phishing works best when the victim is rushed, the lure looks routine, and the infrastructure can be replaced faster than defenders can block it. Malvertising gives attackers a way to place the lure in front of people who are already searching for a service, product, or login page, which increases credibility at the moment of engagement. Short-lived domains add mobility: once a domain is flagged, the campaign can move to a fresh one with minimal cost and limited disruption.

This matters because identity theft usually depends on a narrow window of trust. A believable ad, a convincing login page, and a fast domain swap can defeat reputation-based filtering, user hesitation, and manual takedown workflows. The same pattern also helps attackers segment campaigns so one burned domain does not expose the whole operation. In practice, many security teams encounter the damage after a credential is already replayed rather than when the lure first appears.

How the Attack Path Works in Practice

Attackers often buy or compromise ad inventory, then use the ad to send victims to a redirect chain that lands on a phishing page. The page is usually designed to mimic a familiar identity provider, helpdesk portal, or cloud login flow. The key is not sophistication alone, but timing and churn: the page only needs to remain active long enough to capture a username, password, MFA prompt, or session token before detection catches up.

Short-lived domains support that churn in several ways:

They are cheap to register and easy to abandon after detection.
They can be rotated across registrars, subdomains, and hosting providers to reduce blocking effectiveness.
They often appear less suspicious than obvious typo domains because attackers choose names that resemble normal brand, support, or update language.

For defenders, the technical problem is that trust signals are evaluated at different layers. Email gateway controls are bypassed because the lure is web-delivered. DNS and web filtering may see a domain that is only hours old, while identity teams may only see the login attempt after the credential has already been submitted. NHIMG reports that 91.6% of secrets remain valid five days after the targeted organisation is notified, which underscores how much value attackers get from a brief but successful capture window.

A useful external reference here is the MITRE ATT&CK Enterprise Matrix, which helps teams map the lure, redirect, and credential collection stages to known adversary behaviour. For background on why exposed credentials remain so damaging once captured, see NHIMG’s Ultimate Guide to NHIs.

These controls tend to break down when the organisation relies on static blocklists and delayed takedown processes, because the campaign can retire the infrastructure before those responses complete.

Why the Technique Keeps Working Against Identity Defences

Tighter filtering can reduce phishing volume, but it also increases operational friction because the attacker only needs one successful click and one successful login. That tradeoff is why malvertising remains attractive: it exploits user intent at the exact moment someone is expecting to authenticate. Short-lived domains also create a response problem, not just a detection problem, because defenders may be chasing infrastructure that no longer exists by the time the report is triaged.

There is no universal standard for how long a phishing domain must live before it becomes operationally useful to defenders, but best practice is evolving toward faster telemetry, higher confidence brand monitoring, and browser-side and identity-side detection rather than relying only on domain reputation. This is especially important when a campaign is using lookalike support pages, shared hosting, or compromised legitimate sites, because the URL alone may not be enough to distinguish abuse from normal web traffic. For readers interested in broader NHI exposure patterns, NHIMG’s Key Challenges and Risks section is relevant because the same rapid-rotation logic is frequently used after secrets are stolen.

The main edge case is authenticated single sign-on traffic. If the lure leads to a real identity flow that is proxied or abused rather than obviously fake, the domain may be less important than the session and token handling behind it. In those environments, reputation controls help less than continuous verification and anomaly detection at the identity layer.

Risk and Threat Considerations

Malvertising plus disposable domains creates a concentrated exposure window for credential theft, session hijacking, and brand impersonation. The risk is not only that users visit a fake page, but that the attacker can rapidly replace infrastructure faster than defenders can coordinate blocking, takedown, and user warning.

Failure mechanism: The attacker exploits trusted search or ad pathways to deliver a lure outside email-based controls, then rotates domains to evade reputation systems, sinkholing, and manual abuse handling. That churn is effective because security teams often depend on domain history and repeat sightings, both of which are intentionally denied by short-lived infrastructure.

Impact: Successful captures can lead to account takeover, MFA fatigue or token replay, downstream access to cloud and SaaS systems, and a broader phishing campaign that persists even after the original landing page is removed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1189 — Drive-by Compromise	Malvertising often delivers phishing through web-driven user interaction.
	T1566 — Phishing	The campaign is fundamentally credential theft through deceptive lures.
	T1583 — Acquire Infrastructure	Short-lived domains are attacker infrastructure acquired for disposable use.
Recommendation — Monitor and block ad-delivered redirect chains that land users on credential-harvest pages. Classify and hunt the lure as phishing activity tied to account compromise attempts. Track newly registered and rapidly rotated domains used to support phishing infrastructure.
OWASP Non-Human Identity Top 10	NHI-01 — Secrets and Credential Exposure	Identity phishing seeks reusable credentials, tokens, or session material.
Recommendation — Rotate exposed credentials immediately and invalidate any tokens captured through phishing.
CIS Controls v8	14 — Security Awareness and Skills Training	Users are the delivery target for malvertising-based identity lures.
Recommendation — Train users to verify login destinations before entering credentials on ad-led pages.
NIST CSF 2.0	DE.CM — Continuous Monitoring	Fast-moving phishing requires detection across web, DNS, and identity telemetry.
Recommendation — Correlate DNS, browser, and identity events to detect and disrupt short-lived phishing campaigns.

Practitioner Guidance

What to prioritise: Treat search-ad and browser-delivered lures as an identity problem, not only a web-filtering problem. If a campaign is impersonating a login flow, detection needs to include identity telemetry, page similarity checks, and fast user reporting paths.

What to verify: Confirm that your response process can act on a suspicious domain while it is still live. If takedown, blocklist update, and user notification cannot happen within the likely campaign lifespan, the control is too slow to change outcomes.

Common mistake: Overestimating the value of domain age alone. New domains are a signal, but the more important question is whether the page is collecting credentials or tokens and whether those credentials remain usable after capture.

Practitioner takeaway: The decisive control is not simply preventing every malicious click; it is shrinking the time between lure, detection, and account invalidation so disposable infrastructure cannot outpace response.