New information has surfaced regarding a malicious advertising campaign that exploits Google Ads to direct users searching for popular software to fake landing pages and distribute subsequent-stage malware.

Malwarebytes, the organization that uncovered this activity, noted its uniqueness in user fingerprinting and the distribution of time-sensitive payloads. This attack targets individuals searching for software like Notepad++ and PDF converters. It presents deceptive ads in Google search results that, when clicked, identify and eliminate bots and unintended IP addresses, showing a decoy site.

If the visitor is considered interesting to the threat actor, they are redirected to a counterfeit website advertising the software while secretly fingerprinting the user's system to detect if it's running on a virtual machine. Users who fail this check are taken to the authentic Notepad++ website, while potential targets are assigned unique IDs for tracking and to ensure each download is unique and time-sensitive.

The ultimate-stage malware is an HTA payload that establishes a connection to a remote domain ("mybigeye[.]icu") on a custom port and delivers additional malware. Jérôme Segura, director of threat intelligence, emphasized the successful evasion techniques employed by threat actors, bypassing ad verification checks to target specific victims. This disclosure aligns with a similar campaign targeting users searching for the KeePass password manager with malicious ads that direct victims to a domain using Punycode, a special encoding.

The use of Punycode with rogue Google Ads highlights the increasing sophistication of malvertising through search engines. This tactic aims to trick users into installing malware by registering domain names that appear similar to legitimate ones, executing a homograph attack.

In addition, multiple threat actors have been observed using visual trickery to distribute various malicious payloads, including Cobalt Strike, loaders, stealers, and remote access trojans. They exploit themes related to fake browser updates to gain end-user trust, using compromised websites and tailored lures to persuade users to click.

Source: https://thehackernews.com/2023/10/malvertisers-using-google-ads-to-target.html