A malvertising campaign has been discovered that targets users searching for popular software through Google Ads [1] [2] [3] [4] [5] [6]. This campaign is unique in its ability to fingerprint users and distribute time-sensitive payloads [4]. It overlaps with another campaign that targets users searching for the KeePass password manager [2] [3] [5] [6]. These attacks exploit end user trust and can be initiated through various means [2].
Description
The malvertising campaign utilizes Google Ads to redirect users searching for software like Notepad++ and PDF converters to fake landing pages [1]. These pages fingerprint users’ systems to determine if they are using a virtual machine [3] [4]. If the security check fails [4] [7], users are redirected to the legitimate software website [1] [4] [7]. The final-stage malware establishes a connection to a remote domain and serves additional malware through an HTA payload [3] [4] [6] [7]. The campaign also targets users searching for the KeePass password manager [1] [2] [3] [5] [6], using deceptive domain names created with Punycode. Clicking on the ad redirects users to a decoy site where they are tricked into downloading a malicious installer. Multiple threat actors have been observed using fake browser updates to distribute Cobalt Strike [1] [2] [3] [5] [6], stealers [1] [2] [3] [5] [6], and remote access trojans [1] [2] [3] [5] [6].
Conclusion
These malvertising campaigns highlight the ongoing and evolving threat of malicious advertising. The attackers are successfully bypassing ad verification checks and targeting specific victims [4] [7]. To mitigate these attacks, users should exercise caution when clicking on ads and ensure they are downloading software from legitimate sources. Additionally, organizations should implement robust security measures to detect and prevent malvertising campaigns. The use of deceptive domain names and fake browser updates further emphasizes the need for increased awareness and vigilance in online activities.
References
[1] https://www.linkedin.com/pulse/malvertisers-use-google-ads-target-users-searching-vaibhav
[2] https://mrhacker.co/cyber-attack/malvertisers-using-google-ads-to-target-users-searching-for-popular-software
[3] https://thehackernews.com/2023/10/malvertisers-using-google-ads-to-target.html
[4] https://www.latestly.com/technology/malvertisers-targeting-users-searching-for-popular-software-to-fictitious-landing-pages-and-distribute-next-stage-payloads-via-google-ads-says-report-5506629.html
[5] https://www.443news.com/2023/10/malvertisers-using-google-ads-to-target-users-searching-for-popular-software/
[6] https://beker.uk/2023/10/20/malvertisers-using-google-ads-to-target-users-searching-for-popular-software/
[7] https://menafn.com/1107282321/Malvertisers-Targeting-Users-Searching-For-Popular-Software-Via-Google-Ads-Report
