In a disturbing trend that has gained momentum since late 2024, cybercriminals are increasingly targeting Google Ads accounts belonging to legitimate businesses to serve malicious advertisements.

This sophisticated attack vector, known as malvertising, poses a significant threat to both advertisers and internet users alike.

The scheme involves threat actors compromising Google Ads accounts and using them to create deceptive ads that appear legitimate but lead users to phishing sites or malware-laden downloads.

A malicious ad masquerading as Google Ads (Source – MalwareBytes)

By leveraging the reputation of established companies, these malicious ads often bypass Google’s initial security checks.

Cybersecurity researchers at Malwarebytes have identified multiple campaigns utilizing this tactic. One notable operation impersonates popular software products like Grammarly, Slack, and AnyDesk.

When users click on these ads, they are redirected to convincing clone websites where they unknowingly download trojanized versions of the software, potentially infecting their systems with various types of malware.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

Evasion Techniques

The attackers employ sophisticated techniques to evade detection:

Using Google Sites to host intermediate landing pages, making the ads appear more legitimate.
Implementing cloaking and anti-bot measures to hide malicious content from security scanners.
Exploiting Google Ads’ tracking templates to selectively target victims while redirecting others to legitimate sites.

Perhaps most concerning is the apparent difficulty in shutting down these operations. Researchers have reported instances where the same compromised advertiser accounts were used repeatedly, even after being flagged multiple times.

The impact of these attacks is far-reaching. Not only do they put users at risk of data theft and malware infection, but they also damage the reputation of the companies whose accounts are compromised.

The same ad found in different countries (Source – MalwareBytes)

Additionally, the stolen ad budgets further fund criminal activities. Experts advise both advertisers and users to take precautions:

For advertisers:-

Implement strong account security measures, including two-factor authentication.
Regularly monitor ad campaigns for suspicious activity.
Be cautious of phishing attempts targeting ad account credentials.

For users:-

Exercise caution when clicking on sponsored search results, even for familiar brands.
Verify software downloads by visiting official websites directly rather than through ads.
Keep security software up-to-date to detect potential threats.

However, Google actively investigating and working to address the issue, but the sophisticated nature of these attacks presents a significant challenge.

So, the continued vigilance and cooperation between platforms, advertisers, and users is must to combat these evolving cyber threats.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates

The post Hackers Exploiting Companies’ Google Ads Accounts To Serve Malicious Ads appeared first on Cyber Security News.