Affiliate cookie-stuffing injector: hidden off-screen iframes delivered through ad tags

Tracking only: this hunt does not change any verdict. Exact hostnames of the operator's own hops (a11ybar[.]com, qprskl[.]com, nupdhyzetb[.]com and jhdnntmkom[.]com host ok6.js and stat.js; powered-by-revidy[.]com and nethcdn[.]com receive the hidden iframes; korfo[.]org/to2/<shop>/ is the affiliate redirector), plus the YARA rule Affiliate_Cookie_Stuffing_Hidden_Iframe_Injector, which keys on the injector's code and on the iframes it renders, so the hunt keeps working when the hosts rotate. Two generations were seen: since late 2025, 801x601 iframes at left:-1000px; since September 2026, an ad-SDK shim (window.__ok6_injected__) and a 1x1 sandboxed iframe at -9999px loading //<host>/?ad=1. The ad-network hosts that deliver the loader are deliberately left out: they also serve ordinary ads.