Casino-Themed Websites Conceal PeckBirdy Command Channels
Low-quality Chinese-language gambling and adult websites are being used to camouflage PeckBirdy, a JScript-based command-and-control framework associated with China-aligned threat activity.
The latest findings from Infoblox show how operators are placing malicious infrastructure inside an enormous ecosystem of gambling domains, allowing C2 traffic to resemble ordinary web activity that security teams may dismiss as unwanted browsing. Researchers say the activity has been observed since at least 2023.
The Website Is the Cover Story
One observed domain,vip311[.]cc, appeared to be a Chinese-language casino but contained JavaScript linked to the PeckBirdy infrastructure.
The script registered a service worker and established WebSocket communications withmcp-source[.]online, whilecache-mcp[.]comappeared in the embedded infrastructure.
This layered architecture makes the activity harder to identify with basic reputation checks because the malicious behavior depends on browser-side JavaScript and subsequent network connections rather than an obvious malware download.
Clean Reputation Does Not Mean Clean Infrastructure
Infoblox observed significant differences in security-tool visibility. At the time of its investigation,mcp-source[.]onlinehad no VirusTotal detections, whilecache-mcp[.]comhad only three.
That low detection rate gives operators room to rotate infrastructure before traditional reputation-based controls catch up.
A Huge Casino Ecosystem Provides Natural Cover
Infoblox estimates that more than 1.7 million Chinese-language casino domains are part of the broader illegal gambling ecosystem.
Researchers separate these sites into three broad groups: illegal gambling operations, fraudulent gambling platforms that prevent withdrawals, and a much smaller set of sites used as PeckBirdy decoys.
The third category is particularly relevant to defenders because the casino content can serve as camouflage rather than the actual purpose of the infrastructure.
PeckBirdy Extends Beyond the Casino Theme
The latest activity also includes Chinese-language adult websites, expanding the range of seemingly low-priority destinations that can conceal malicious communications.
Earlier research associated PeckBirdy with compromised gambling websites and malicious scripts capable of supporting remote JavaScript execution and follow-on malware delivery. The framework has also been linked to backdoors including MKDOOR and HOLODONUT.
The Detection Problem Is Behavioral
Infoblox reported that just over 3% of its enterprise customers had resolved at least one PeckBirdy C2 domain.
A single lookup is not necessarily evidence of compromise. However, connections to multiple distinct PeckBirdy-related domains deserve closer investigation, particularly when DNS activity is accompanied by unusual browser behavior, service-worker registration or suspicious WebSocket connections.