The Laura Kuenssberg deepfake crypto scam ads are still going on X, with this campaign saying "I wonder what's in the bag" in a bedroom with an unknown man. We detected over 133,000 impressions of this bad ad variant today. The threat actors use the Linktree link shortener (tr•ee) to serve the initial link that the user clicks, then transfer to their self-hosted traffic redirect service, to decide in realtime whether to send the user to their cryptocurrency scam campaign site or an Amazon affiliate-tagged product page (where the scammer still earns revenue share). The destination is a runtime heuristic decision, scoring the user on device characteristics, geolocation and security sandbox probability. When the ad is posted, X evaluates the link in its sandbox, and like many of these deepfake celebrity scam ads, it is provided with the final URL of the Amazon website, so determines the ad is safe. X should display the initial URL in ads. X and Linktree should move to resolve redirects and check URLs in realtime, at click-time, to limit traffic-shifting redirect chain attacks. IOCs (malicious URLs): - https[://]tr[.]ee/WvJpwM - hic-consequatur-in[.]top Epi Security marks the IOCs as malicious, and Epi is the only known cybersecurity vendor that signals both as unsafe.