Malvertising campaign MasquerAds abuses Google Ads

Experts warn of a new Malvertising Campaign abusing Google Ads that targets users searching for popular software.

Guardio Labs researchers uncovered a malvertising campaign, tracked as MasquerAds and attributed to a threat actor known as Vermux, that is abusing Google Ads to target users that are searching for popular software.

The campaign aims at delivering tainted versions of popular software that deploy malicious payloads on the user’s machine, including info-stealing malware such as Raccoon Stealer and Vidar.

The threat actors behind this campaign used domains with typosquatted names that appeared on top of Google search results.

The attacker used a set of benign sites, which were designed to trick visitors into clicking on them, and then redirect them to rogue sites.

“The trick is simple — creating a benign site to be promoted with the wanted keyword and keeping it valid and safe in the eyes of the policy enforcer.” reads the analysis published by Guardio Labs. “Yet, the moment those “disguised” sites are being visited by targeted visitors (those who actually click on the promoted search result) the server immediately redirects them to the rogue site and from there to the malicious payload — usually also hiding inside reputable file sharing and code hosting servers like GitHub, dropbox, discord’s CDN, etc.”

Some of the software that was impersonated by the threat actors are Grammarly, Malwarebytes, Afterburner, Zoom, Slack, Brave, and Tor.

Threat actors put a significant effort into the malicious payload employed in the campaign, for example, they employed stealers that are able to avoid defense solutions.

“Even for Virus-Total, it took several days since our submission to get more than a few heuristic detections” continues the report.

Vermux deployed hundreds of domains and its servers were located mostly in Russia, while the rogue ads mainly targeted users in USA and Canada.

“This “masquerAd” concept is simple yet does exactly what those actors need — abuse the trust we sometimes blindly give to Google and their promoted search results. Adding to the above, the abuse of reputable file-sharing services as well as well-known software brands make them evade even the most advanced EDRs on the market. It’s inevitable to apply a more behavioral and unbiased protection level — even for the plainest and most common action like googling something up…” concludes the report, which also includes Indicators of Compromise. “Don’t get fooled by misspelled domain names, and always double-check where you download your files from!”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Malvertising Campaign)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.