Technology

59347 readers

4956 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

477

Google ads push fake Google Authenticator site installing malware | The ad displays "google.com" and "https://www.google.com" as the click URL, and the advertiser's identity is verified by Google (www.bleepingcomputer.com)

submitted 3 months ago by [email protected] to c/[email protected]

27 comments fedilink hide all child comments

Google has fallen victim to its own ad platform, allowing threat actors to create fake Google Authenticator ads that push the DeerStealer information-stealing malware.

In a new malvertising campaign found by Malwarebytes, threat actors created ads that display an advertisement for Google Authenticator when users search for the software in Google search.

What makes the ad more convincing is that it shows 'google.com' and "https://www.google.com" as the click URL, which clearly should not be allowed when a third party creates the advertisement.

We have seen this very effective URL cloaking strategy in past malvertising campaigns, including for KeePass, Arc browser, YouTube, and Amazon. Still, Google continues to fail to detect when these imposter ads are created.

Malwarebytes noted that the advertiser's identity is verified by Google, showing another weakness in the ad platform that threat actors abuse.

When the download is executed, it will launch the DeerStealer information-stealing malware, which steals credentials, cookies, and other information stored in your web browser.

Users looking to download software are recommended to avoid clicking on promoted results on Google Search, use an ad blocker, or bookmark the URLs of software projects they typically use.

Before downloading a file, ensure that the URL you're on corresponds to the project's official domain. Also, always scan downloaded files with an up-to-date AV tool before executing.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 24 points 3 months ago

This kind of shit is why Googles (and anyone else that tries it as well) ever increasing push to put a layer of ads into anything is so off putting to me. Sure ads are annoying, but they are also probably second only to social engineering as the method for someones device and accounts getting compromised.

I personally will not go back to the days where just the act of visiting a website and clicking on nothing has a good chance of loading some Javascript and infecting my browser or whole device with the drive by malware of the day because the shit heads that run the site are to lazy to vet what they are letting their site call out too and the third party ad networks are to lazy to vet what sorts of things they are allowing their ad networks to serve.