Scammers abusing Google AdWords to spread malware

Scammers are abusing Adwords, the search engine giant advertising platform, to spread to people looking for legitimate and popular software.

Google’s safety measures are usually robust, but experts found that they managed to employ a workaround.

The campaign is simple IndustryGrammarly, MSI Afterburner, Slack, or others, and infect them with an infostealer. In this case, the attackers were adding Raccoon Stealer, and IceID malware loader. Then, they would create a landing page where the victims would be sent to download the malicious programs. These pages were designed to look seemingly identical to the legitimate ones.

Tricking Google

Then, they would create an ad and place it on Google Adwords. That way, whenever someone searches for either these programs or other relevant keywords, they’d see the ads in various places (including the top positions on the Google search engine results page).

The trick is that Google’s algorithm is relatively good at spotting malicious landing pages hosting dangerous software. To bypass the security measures, the attackers would also create a benign landing page to which the ad would send the visitors.

That landing page would then immediately redirect the victims to the malicious one. 

Cyberattack campaigns that leverage legitimate software to distribute malware are nothing new, but researchers have mostly been in the dark when it comes to methods to actually get people to the landing pages. In late October, researchers discovered a major campaign with more than 200 fraudulent domains, but up until today, no one knew how the domains were advertised.

Now that the plot has been discovered, Google can be expected to swiftly terminate the campaign (if it hadn’t done that already).

You might also like

Comments are closed.

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. AcceptRead More