A new fraud is currently affecting Google users through malicious advertising. Discovered on January 16, 2025, this scam is one of the most ingenious ever detected. So, how to identify it and protect yourself?
Cybercriminals are more cunning than ever. At a time when online vigilance is at its height, they still manage to bypass security measures and go unnoticed. A new malicious advertising campaign, discovered by Malwarebytes Labs experts, is enough to send chills down your spine.
Indeed, it uses Google Ads, a supposedly reliable service, to spread advertisements that redirect users to phishing sites. Once on these sites, victims are prompted to log in to their Google account. By entering their credentials, they allow hackers to access their account, divert their advertising revenue and even take possession of the Google Ads profile.
Concretely, advertising that could potentially interest the targeted Internet user respects the standards by displaying a URL that appears normal at first glance. This is why the victims suspect nothing. But, once the user logs into a fraudulent site and enters their credentials, hackers take control of the account. They create a new Google Ads account and divert the victim’s income. Worse yet, they often exclude the rightful owner from their own account. The fraudsters’ end goal is to resell the stolen accounts on the dark web and launch other phishing campaigns. Malwarebytes Labs has also revealed several phishing campaigns linked to this fraud, notably in Portugal, Brazil, Hong Kong and Eastern Europe, demonstrating the global scale of this scam.
So, to avoid falling into this trap, always check the URL of the sites you visit, even if the advertising seems trustworthy. If a site asks you to log in with your credentials, make sure it is an official site. If in doubt, it is better to leave the page and search for the service directly through Google. Also use a password manager, which can alert you if you enter your credentials on a suspicious site. If you manage a Google Ads account, pay close attention to unusual activity and enable two-step verification to increase the security of your accounts. You will have understood, stay vigilant.