Researchers at Malwarebytes are tracking a major malvertising campaign that’s abusing Google Ads to target individuals and businesses interested in advertising.
The threat actors are using compromised Google Ads accounts to run ads that impersonate Google, leading victims to a fake Google login page designed to steal their credentials.
“This is the most egregious malvertising operation we have ever tracked, getting to the core of Google’s business and likely affecting thousands of their customers worldwide,” Malwarebytes says. “We have been reporting new incidents around the clock and yet keep identifying new ones, even at the time of publication.”
Notably, the attackers use a Google Sites page to host a portal that leads to the phishing page, lending legitimacy to the scam.
“There’s a good reason to use Google Sites, not only because it’s a free and a disposable commodity but also because it allows for complete impersonation,” the researchers explain. “Indeed, you cannot show a URL in an ad unless your landing page (final URL) matches the same domain name. While that is a rule meant to protect abuse and impersonation, it is one that is very easy to get around.
Looking back at the ad and the Google Sites page, we see that this malicious ad does not strictly violate the rule since sites.google.com uses the same root domains ads ads.google.com. In other words, it is allowed to show this URL in the ad, therefore making it indistinguishable from the same ad put out by Google LLC.”
Some of the malicious ads are designed to target individuals who already advertise with Google Ads. The researchers note, “We believe their goal is to resell those accounts on blackhat forums, while also keeping some to themselves to perpetuate these campaigns.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Malwarebytes has the story.
