Cybersecurity keeps evolving, and so do threats. One such threat is malvertising, it exploits the tools made for enhancing our digital threats. A recent campaign has surfaced, targeting Google products through malicious search ads, displaying the persistence and sophistication of threat attackers. The blog dives into the details of this campaign, its impact, and the steps users can take to protect themselves.

Malvertising, which comes from malicious + advertising involves the use of online advertisements to spread malware. Cybercriminals purchase ad space on legitimate websites, embedding malicious code within the ads. When users click these ads, they are redirected to malicious websites or have malware silently installed on their devices.

The Campaign Against Google Products

The recent campaign showcases the ingenuity of cybercriminals. By targeting dozens of Google products through malicious search ads, scammers managed to deceive users into visiting a fake Google homepage. This fake page, created using Looker Studio, was designed to lock up the browsers of both Windows and Mac users, effectively trapping them in a malicious environment.

The attackers utilized stolen or free accounts and leveraged Google's APIs to generate rotating malicious URLs. This tactic made it difficult for security systems to detect and block malicious ads and ensured a steady stream of potential victims.

The Mechanics of the Attack

1. Ad Placement: Cybercriminals purchased ad space on legitimate platforms, ensuring their malicious ads appeared in search results for popular Google products.

2. Redirection: When users clicked on these ads, they were redirected to a fake Google homepage. This page was meticulously crafted to resemble the genuine Google site, adding a layer of credibility to the scam.

3. Browser Lock: The fake homepage employed scripts to lock the user's browser, preventing them from navigating away or closing the tab. This tactic often creates a sense of urgency and panic, compelling users to follow the attackers' instructions.

4. Rotating URLs: By using Google's APIs, the attackers generated rotating URLs, making it challenging for security systems to blacklist the malicious sites. This ensured the longevity and effectiveness of the campaign.

What it means for Users

The impact of such a campaign is far-reaching. Users who fall victim to these scams can experience a range of consequences, from minor annoyances to significant security breaches. The immediate impact includes browser hijacking, which can disrupt productivity and cause frustration. However, the long-term consequences can be more severe, including the installation of malware, theft of personal information, and financial loss.

How to stay safe

• Ad blockers can prevent malicious ads from appearing in your search results and on websites you visit. While not foolproof, they add an extra layer of security.
• Before clicking on any ad, hover over the link to see the URL. Ensure it matches the official website of the product or service you are interested in.
• Regularly update your browser, operating system, and security software. Updates often include patches for vulnerabilities that cybercriminals exploit.
• Utilize built-in security features in your browser and operating system. Features like pop-up blockers and safe browsing modes can help mitigate the risk of malvertising.
• Stay informed about the latest cybersecurity threats and trends. Awareness is a powerful tool in preventing cyberattacks.