Overview
A sophisticated malvertising campaign is actively targeting Google Ads users through compromised advertising accounts using credential theft and 2FA bypass techniques. The attackers leverage Google Sites infrastructure to host deceptive landing pages that capture login credentials and authentication codes
Whom it may concern
- Marketing departments using Google Ads
- Digital advertising agencies
- Small business advertisers
- Account security administrators
Key Findings
- Attackers exploit URL display flexibility in Google Ads platform
- Campaign detected since November 2024 with widespread impact
- Stolen credentials used to propagate attacks through legitimate accounts
- Advanced evasion techniques including traffic fingerprinting and anti-bot measures
Risk Analysis
- Probability: High (active campaign with multiple confirmed victims)
- Impact: Severe (financial exposure through ad budget theft)
- Attack Sophistication: High (multiple technical layers and evasion mechanisms)
- Detection Difficulty: High (legitimate infrastructure abuse)
Action Items
- Enable hardware-based 2FA for all ad accounts
- Implement strict URL monitoring for ad destinations
- Establish incident response procedures for compromised accounts
- Deploy automated budget monitoring systems
Sources
- [The Hacker News](https://thehackernews.com/2025/01/google-ads-users-targeted-in.html)
