Malvertising campaign in Google Search redirected users to tech support scam

Malicious ads in Google search results for the US retail giant Target redirected users to a tech support scam.

The malvertising campaign was first reported last week by a US user who posted his observations to a StackExchange thread and was then reported by Bleepingcomputer.com.

Just querying Google for the term “target,” users were displayed on the top right of the page of the results the malicious ads.

The bogus ads leverage a feature of oogle Ads service that allows ad publishers to display a URL while redirecting users to another URL.

In the specific case, the rogue ad displayed the link “target.com,” but users were redirected to “tech-supportcenter.us.”

In the attack reported by the US users, when users clicked the malicious ad they were redirected to a tech support scam instead of the legitimate website Target.com.

The landing page was a fake Microsoft tech support page urging users to call a phone number to remove a non-existent “HARDDISK_ROOTKIT_TROJAN_HUACK.EXE” file.

The landing page was registered to a Georgian man and was hosted on two IP addresses, 104.28.19[.]58 and 104.28.18[.]58], that were involved in the past in similar fraudulent activities, including tech support scams, malware hosting, and pharma spam.

According to VirusTotal logs the malvertising campaign also targeted Walmart users.

Unfortunately, such kind of attacks is not new for cybersecurity experts, in the past other malvertising campaigns hit Google.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Malicious ads, malvertising)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.