{"id":6935,"date":"2025-01-15T15:33:00","date_gmt":"2025-01-15T21:33:00","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/attackers-hijack-google-advertiser-accounts-malware"},"modified":"2025-01-15T15:33:00","modified_gmt":"2025-01-15T21:33:00","slug":"attackers-hijack-google-advertiser-accounts-to-spread-malware","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/01\/15\/attackers-hijack-google-advertiser-accounts-to-spread-malware\/","title":{"rendered":"Attackers Hijack Google Advertiser Accounts to Spread Malware"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

In an especially brazen tactic, multiple threat actors are impersonating Google Ads login pages to trick advertisers into handing over their account credentials.<\/span><\/p>\n

The attackers \u2014 from regions as geographically dispersed as South America, Asia, and Eastern Europe \u2014 are then using the hijacked accounts in real-time to buy and distribute malicious advertisements and malware via Google Ads.<\/span><\/p>\n

‘Most Egregious’ Malvertising Campaign Ever<\/h2>\n

The scammers appear to be succeeding in many cases because their ads are allowed to show an <\/span>ads.google.com<\/a><\/span> URL. This makes them virtually indistinguishable from legitimate Google ads, according to researchers at Malwarebytes, who spotted the malicious activity recently.<\/span><\/p>\n

“This is the most egregious malvertising operation we have ever tracked, getting to the core of Google’s business and likely affecting thousands of their customers worldwide,” Malwarebytes researcher Jerome Segura <\/span>wrote in a blog post<\/a><\/span> this week. “We have been reporting new incidents around the clock and yet keep identifying new ones, even at the time of publication.”<\/span><\/p>\n

Google Ads<\/a><\/span> is an advertising platform that enables businesses and individuals to display targeted ads across Google’s search results, websites, mobile apps, and other online properties, based on user search behavior and interests. Often, the top search results are sponsored, meaning someone paid for that high visibility. For context, Google Search generated some <\/span>$175 billion<\/a><\/span> in ad revenue in 2023.<\/span><\/p>\n

Related:<\/span>CISA: Second BeyondTrust Vulnerability Added to KEV Catalog<\/a><\/p>\n

According to Segura, there has been a recent flood of fake sponsored ads for Google Ads directed at businesses and individuals looking to advertise on Google Search or wanting to sign in to their Google Ads accounts. The ads appear to be from Google and purport to either help people sign up for a Google Ads account or to sign in to an existing account. Users clicking on these ads are directed to a fake Google Ads home page from which they are directed to external sites designed specifically to steal usernames and passwords to the advertiser’s Google accounts.<\/span><\/p>\n

The attackers are using Google’s free website creation platform, Google Sites, to host the lure pages. It is a tactic that Segura says allows them to trivially bypass a Google policy that allows advertisers to include a URL in their ads only if the URL matches the domain name of the advertiser. “Looking back at the ad and the Google Sites page, we see that [the] malicious [ads do] not strictly violate the rule since sites.google.com uses the same root domains as ads.google.com,” Segura said. “In other words, it is allowed to show this URL in the ad, therefore making it indistinguishable from the same ad put out by Google LLC.”<\/span><\/p>\n

Related:<\/span>OWASP’s New LLM Top 10 Shows Emerging AI Threats<\/a><\/p>\n

Google Is Actively Investigating Cyberattacks<\/h2>\n

In an emailed comment, a Google spokesman said the company is currently “actively investigating” the issue and working on a quick fix for the problem. “We expressly prohibit ads that aim to deceive people in order to steal their information or scam them,” the spokesperson said.<\/span><\/p>\n

As context, the spokesperson pointed to the <\/span>growing sophistication<\/a><\/span> and scale of malvertising campaigns and noted instances where threat actors have created thousands of malicious accounts simultaneously to <\/span>distribute malicious ads<\/a><\/span> on Google properties. Often these actors are using techniques such as text manipulation to get around automation detection mechanisms. In other instances, they use cloaking tactics to show Google reviewers and systems different ads from the ones that users end up seeing. “To provide a sense of the scale of our <\/span>enforcement efforts in 2023<\/a><\/span>, we removed over 3.4 billion ads, restricted over 5.7 billion ads, and suspended over 5.6 million advertiser accounts,” the spokesman said.<\/span><\/p>\n

Impersonating Google Ads: Simple & Effective Social Engineering<\/h2>\n

Related:<\/span>Apple Bug Allows Root Protections Bypass Without Physical Access<\/a><\/p>\n

In comments to Dark Reading, Segura says the most notable part of the new malicious activity is the impersonation of the Google Ads brand by combining Google Sites URLs with the ads. “It’s a simple and yet effective trick that makes those ads incredibly hard to differentiate from the real ones,” Segura says. Complicating matters is the fact that bad actors are often using compromised Google Ads accounts to place even more fake ads in Google Search, making the activity challenging to stop.<\/span><\/p>\n

Google should be making it harder for bad actors to pull off such impersonation schemes, he says. “The ‘how’ is more complicated, as it involves reviewing business practices and \u2026 existing security policies.”<\/span><\/p>\n

Segura says Malwarebytes is tracking and reporting each malvertising incident it comes across via a live tracker that the Google Ads team can access. “This has been a helpful tool for us, not only to make the reporting process easier but also to keep a historical record,” he notes. Google’s response has consisted of taking action on ads that Malwarebytes report. “[But] the threat actors are able to get right back as if the campaign never stopped. We are talking about dozens of accounts that get burned but yet there are enough to keep this going indefinitely.”<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

In an especially brazen tactic, multiple threat actors are impersonating<\/p>\n","protected":false},"author":12,"featured_media":6936,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-6935","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?fit=1920%2C1080&ssl=1",1920,1080,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?fit=1920%2C1080&ssl=1",1920,1080,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/attackers-hijack-google-advertiser-accounts-to-spread-malware.jpg?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6935","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=6935"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6935\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/6936"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=6935"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=6935"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=6935"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}