Cybercriminals have found a clever and largely invisible way to send unsuspecting internet users straight to fake or compromised websites, and the FBI wants the public to know about it.

The method involves a technology called a Traffic Distribution System, or TDS, which is normally used by legitimate businesses to manage and route web traffic. In the wrong hands, it becomes a powerful tool for fraud, data theft, and ransomware delivery.

A TDS works by sitting between a user and their intended destination on the web. When a person clicks a link, visits a page, signs up for a promotion, or downloads an application, the TDS quietly decides where to send them next.

Cybercriminals have weaponized this process to steer victims toward phishing pages, fake login portals, and sites designed to push malware onto devices without any clear warning sign.

The FBI, in a report shared with Cyber Security News (CSN), identified this growing misuse of traffic distribution systems and issued a formal Public Service Announcement on June 18, 2026.

Analysts noted that these attacks are becoming harder to detect because the TDS masks the final malicious destination behind a chain of intermediate steps, making it difficult for both users and security tools to catch them in time.

What makes this threat particularly worrying is that it does not rely on just one attack method.

Criminals are using phishing emails, poisoned search engine results, and even compromised legitimate websites to funnel users into their TDS traps.

Once inside that chain, victims may never realize they have been redirected at all, as the process is completely silent and happens within seconds.

The consequences can be severe. Once a user lands on a malicious site, their device may be infected with malware, their credentials stolen through fake login pages, or their network access quietly sold to ransomware groups.

The FBI has made clear this is not a niche or emerging threat but one actively being used against everyday internet users and businesses of all sizes.

FBI Warns Cybercriminals Use Traffic Distribution Systems

One of the most dangerous features of a malicious TDS is its ability to filter who gets redirected and who does not.

Before sending a user to a harmful destination, the system silently collects data points such as their IP address, geographic location, operating system, and browser type.

This lets criminals skip users from regions they are not targeting and show safe content to security researchers who might be investigating.

This filtering capability means that traditional security scans can miss the threat entirely. A researcher visiting a compromised website might see nothing unusual, while a targeted user in a specific country gets pushed straight to a phishing page.

This level of operational precision makes the TDS a preferred tool for sophisticated criminal groups, including those tied to ransomware campaigns.

Protecting Yourself and Your Organization

The FBI has outlined a clear set of steps that both individuals and businesses can take to lower their risk.

For everyday users, the most important habit is checking URLs carefully before clicking any advertisement or unfamiliar link, since a malicious address often looks nearly identical to a trusted one.

Enabling two-factor authentication and using strong unique passwords are also strongly recommended.

Keeping all software, website plugins, and themes consistently updated is equally critical, as criminals frequently exploit security gaps in outdated systems.

Installing a Web Application Firewall adds another layer of protection that can block malicious traffic before it reaches a user’s device or network.

For businesses, the FBI advises monitoring endpoints for unusual script activity, particularly around files with js, ps1, or svg extensions.

Organizations should also audit web hosting and content management accounts regularly, and invest in employee training to help staff identify phishing and social engineering attempts.

Anyone who suspects their website has been compromised should file a complaint with the Internet Crime Complaint Center at www.ic3.gov or contact a local FBI Field Office directly.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.