I was approached the 12 Sept on a underground forum.
Here a some parts of my conversations, may that can interest some of you.
19 Sept: AV program launched.
AffiliateID is used here to reconize the partner:
http://totalsolutionantivirus.com/order/pay.php lead to https://migs.mastercard.com.au/vpcpay?o=pt&DOID=F0CCA67DEC356EFB40267C4896237237&paymentId=3842949780467128039
After a css file is added and the page is miraculously changed
Satisfied partner, good payments: