Cybercriminals have found a clever and largely invisible way to send unsuspecting internet users straight to fake or compromised websites, and the FBI wants the public to know about it. The method involves a technology called a Traffic Distribution System, or TDS, which is normally used by legitimate businesses to manage and route web traffic. In the wrong hands, it becomes a powerful tool for fraud, data theft, and ransomware delivery.

A TDS works by sitting between a user and their intended destination on the web. When a person clicks a link, visits a page, signs up for a promotion, or downloads an application, the TDS quietly decides where to send them next. Cybercriminals have weaponized this process to steer victims toward phishing pages, fake login portals, and sites designed to push malware onto devices without any clear warning sign.

The FBI, in a report shared with Cyber Security News (CSN), identified this growing misuse of traffic distribution systems and issued a formal Public Service Announcement on June 18, 2026. Analysts noted that these attacks are becoming harder to detect because the TDS masks the final malicious destination behind a chain of intermediate steps, making it difficult for both users and security tools to catch them in time. What makes this threat particularly worrying is that it does not rely on just one attack method. Criminals are using phishing emails, poisoned search engine results, and even compromised legitimate websites to funnel users into their TDS traps. Once inside that chain, victims may never realize they have been redirected at all, as the process is completely silent and happens within seconds.

The consequences can be severe. Once a user lands on a malicious site, their device may be infected with malware, their credentials stolen through fake login pages, or their network access quietly sold to ransomware groups. The FBI has made clear this is not a niche or emerging threat but one actively being used against everyday internet users and businesses of all sizes.

One of the most dangerous features of a malicious TDS is its ability to filter who gets redirected and who does not. Before sending a user to a harmful destination, the system silently collects data points such as their IP address, geographic location, operating system, and browser type. This lets criminals skip users from regions they are not targeting and show safe content to security researchers who might be investigating. This filtering capability means that traditional security scans can miss the threat entirely. A researcher visiting a compromised website might see nothing unusual, while a targeted user in a specific country gets pushed straight to a phishing page. This level of operational precision makes the TDS a preferred tool for sophisticated criminal groups, including those tied to ransomware campaigns.

The FBI has outlined a clear set of protective measures, urging users and organizations to stay vigilant against these invisible redirects.