Threat Actors use Google Ads to Target People Migrating to Encrypted Messaging Services like Signal and Telegram

Threat Actors use Google Ads to Target PeopleResearchers at eSentire warn that threat actors have been using Google Ads to target people migrating from WhatsApp to other encrypted messaging services, particularly Signal and Telegram.

“According to eSentire’s security research team, the Threat Response Unit (TRU), this latest campaign relies on the use of malicious Google Ads and web pages that replicate the legitimate download page for secure chat applications, such as Signal,” the researchers write. “Using the fake Signal page, this malicious campaign’s objective is to socially engineer victims into downloading and executing Redline Stealer. Stolen information can be sold on the dark web or directly used in further intrusions and fraud campaigns. Similar malicious Google ad campaigns have recently been observed using AnyDesk, DropBox and Telegram as lures.”

The researchers believe the attackers were taking advantage of the millions of people migrating from WhatsApp to other encrypted messaging apps following a widely undesirable update to WhatsApp’s terms of services in January.

The researchers also note that observant users could have recognized that the pages were malicious if they knew what to look for.

“Evidence that the fake, ad-based Signal page is malicious is as follows: Most of the links do not work on the fake Signal page but do on the real Signal page,” the researchers write. “Secondly, the download button on the fake page (the one button that works) depends on an unknown php script controlled on the server side; the fake Signal page delivered an outdated version of Signal when TRU attempted the download, potentially a result of the server detecting the security tools used. Thirdly, the top-level domains for the fake Signal download page are not standard top-level domains. Finally, all the suspicious ads share a hosting provider, NameCheap. An analysis of registration and hosting parameters across a sample of suspicious sites of the ‘same structure’ (as defined by Urlscan) demonstrates the potential for multiple malvertising campaigns.”

New-school security awareness training can enable your employees to recognize social engineering tactics.

eSentire has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Cybersecurity Awareness Month Resource Kit

Get the latest about social engineering

Subscribe to CyberheistNews