Malicious Ads on Google Targeting Major Brands

Malvertising, the practice of distributing malware through online advertisements, has increasingly targeted prominent brands such as eBay, Canva, and even Google itself. These deceptive ads appear legitimate, often mimicking the brands they exploit, but redirect users to malicious sites or initiate harmful downloads.

eBay: In November 2024, a significant malvertising campaign targeted eBay users. Searches for terms like "eBay phone number" or "eBay customer service" on Google displayed fraudulent ads prominently. These ads, masquerading as official eBay support, redirected users to bogus websites prompting them to call fake assistance numbers, leading unsuspecting individuals into scams. 

Canva: In August 2024, fraudulent ads impersonating the design platform Canva were identified. Displayed at the top of Google search results, these ads led users to a deceptive page replicating Canva's homepage. Interacting with this page resulted in browser hijacks featuring fake Microsoft alerts, aiming to deceive users into engaging with malicious content. 

Google: Even Google has not been immune to such attacks. In October 2024, a large-scale malvertising campaign targeted utility software through Google Ads. These malicious ads redirected users to decoy sites, facilitating the distribution of malware. Despite Google's efforts to remove these ads and suspend the advertisers, new malicious ads reappeared shortly thereafter, indicating the persistence and adaptability of the threat actors involved. 

Malvertisers employ sophisticated techniques to evade detection and exploit users:

•    Ad Content Mimicry: Malicious ads closely resemble genuine ads in design and content, deceiving users into believing they are legitimate. 
•    Keyword Hijacking: Attackers purchase ads for popular keywords, ensuring their malicious ads appear alongside legitimate search results. 
•    Cloaking and Decoy Sites: Malvertisers use redirection chains involving click trackers and decoy sites to profile victims and avoid automated detection, prolonging the lifespan of the malicious ads. 

Malvertising presents a persistent threat to both users and reputable brands. The increasing sophistication of these attacks necessitates ongoing vigilance, enhanced security measures, and user education to mitigate risks and maintain trust in digital platforms.