In recent years, hackers have discovered new methods to spread their malware in order to steal any information they can. The hacker has been reported to be using Google Ads in order to make money, according to Bleeping Computer. Approximately a dozen domains have been reported to be hosting the WindowsReport independent media site. '
To infiltrate Google's advertising network, hackers disguise themselves using this method before setting up their own accounts.
Hackers provided a run-up of CPU-Z over the fake WindowsReport website on which hackers hosted their exploit. In Windows, CPU-Z is one of the most useful free tools available for monitoring the hardware components of the computer. When searched before the site is traced, that site will end up as a RedLine Stealer or malicious application to steal information from users.
The software allows hackers to filter sensitive system data including stored passwords, payment information, cookies, cryptocurrency wallets, and similar information in order to gain access to systems.
In order to attract large numbers of people to click on these malicious CPU-Zs in Google Ads, hackers intentionally promote these malicious CPU-Zs in Google Ads advertisements.
A number of diversions will be needed to let the users avoid Google's anti-familication cranes before they are allowed to enter the actual CPU-Z site.
A cloned version of WindowsReport has been created, as per the researchers, in order to add legitimacy and trustworthiness to the entire campaign. Researchers also found that before users are redirected to the cloned website, they pass through a number of redirects in order to avoid Google's anti-abuse spiders.
Those who are redirected to benign pages are more likely to be redirected to the final website. It is not clear exactly how attackers decide which users to send RedLine to, as it remains unclear how they choose those users. In addition, the installer is digitally signed with a valid certificate, so it is likely that Windows security tools and other antivirus products will not identify it as malicious, which makes matters worse.
According to Malwarebytes, the attackers who were behind this campaign are the same people who created the Notepad++ attack recently, based on their analysis of the threat actors' infrastructure. It was similar in that the malware was accompanied by a copy of a legitimate website and malicious ads, all of which were served through Google Adwords. It was discovered late in October that this campaign had similar characteristics.
When searching for products and solutions on Google, make sure to be extra cautious when downloading anything and double-check the URL in the address bar in order to ensure that the website you are going to download is safe before downloading anything.
Recent revelations of hackers exploiting Google Adwords to spread malware highlight the need for enhanced cyber vigilance in an ever-evolving landscape of digital threats.
The curtain is falling on this nefarious act, and as a result, users are reminded to be cautious when navigating through the vast online landscape.
In addition to the deceptions the hackers used to deceive us, they also created cloned legitimacy in order to gain credibility. This shows how sophisticated cyber threats have become in the modern era.
There has been no shortage of attacks that use the cloak of Google Adwords as a means of spreading their malicious agenda in this symphony of disguise, previously linked to the Notepad++ attack.
In this digital age of scrutiny, awareness is our greatest shield, and scrutiny is users' armour as the digital curtain falls. This should serve as a reminder as the digital curtain falls.
