Malicious actors are abusing Google Ads to drive traffic to malicious websites where malware is downloaded, and abuse of Google Ads for malware distribution is increasing. Google places its Ad blocks at the top of the page, so the adverts are the first thing people see when the search results are generated. The adverts are tailored to specific search terms and are effective at driving traffic to legitimate websites. Consumers are made aware that the links displayed at the top of the search results are sponsored but users trust that the adverts will direct them to businesses that provide legitimate products and services. Google has many checks in place to prevent abuse of its ad network and conducts stringent verification checks on new ads before allowing them to be displayed; however, malicious actors are able to circumvent these checks.
One technique that malicious actors deploy to get their malicious adverts displayed is to create a clone of a legitimate website or product and offer a Trojanized version of a product for download on that page. Alternatively, a benign website can be used until verification has taken place and it can then be updated to include malicious content.
These malicious webpages typically offer popular software products such as AnyDesk, Teamviewer, Dashlane, and Malwarebytes software. Since the website used by the scammers looks legitimate, there is a reasonable chance that the malicious software will be downloaded and installed. Since the user gets the product they are seeking, they are unlikely to realize anything untoward has happened, but while the legitimate software is installing, malware will also be silently installed. A variety of malware families are being delivered using this method, such as RacoonStealer, RedLine, Cobalt Strike, and the IcedID malware loader.
Security-aware individuals may check the domain of the site before downloading any files to make sure it is legitimate, so to make these campaigns more believable, the domains used are very similar to the legitimate domains, often differing by one or two characters or using hyphenated domains relevant to the product being offered – dashlane-download.com for example.
A new campaign has recently been detected that offers the AnyDesk remote desktop application. Google Ads are displayed for related search queries, and the user is directed to the attacker-controlled site where they download an MSI installer, which uses PowerShell to download the malware payload, which is executed via rundll32. Once installed, the malware connects with its C2 server and awaits instructions.
The malware – Lobshot – is a financial Trojan and information stealer for Windows systems that was first detected in the summer of 2022. The malware is stealthy and can remain undetected in systems and gives hackers hidden VNC access to Windows devices. The malware is capable of stealing from more than 50 cryptocurrency wallets in popular web browsers but also allows the hackers to remotely access an infected device and control that device without being detected by the user.
Malicious actors are increasingly using Google Ads for malware distribution, as well as search engine poisoning. The latter involves using search engine optimization techniques to get malicious websites to appear high up in the organic search engine listings for key business search terms, such as searches for business software and contract and agreement templates.
Businesses can protect against malware downloads via the web by using a web filter. Web filters will block access to known malicious URLs and can be configured to block specific file downloads from the internet, such as executable files, thereby preventing unauthorized software installations. They can also be used to carefully control the websites that employees can access when on or off the network.
