Hackers use Google Ads to spread malware in sneaky scheme

TLDR:

• Google Ads tracking feature exploited by hackers to deliver malware disguised as popular groupware installers.
• Malicious ads redirect clickers to download harmful files from compromised domains, injecting malware into legitimate Windows files.

In a recent discovery, AhnLab Security Intelligence Center (ASEC) found that hackers are using the Google Ads Tracking feature to distribute malware disguised as popular groupware installers like Notion and Slack. By abusing the tracking feature, hackers redirect clickers to download harmful files from compromised domains, injecting the Rhadamanthys infostealer malware into legitimate Windows files like dialer.exe, openwith.exe, dllhost.exe, and rundll32.exe.

The malicious ad example shows a tracking URL hidden from users, redirecting them to a concealed tracking template URL rather than the displayed final URL. The final landing page mimics legitimate groupware sites, tricking visitors into downloading and running the malware, completing a multi-stage infection process.

Users are advised to carefully verify URLs when accessing sites and not trust the advertised banner URL. This case confirms that attackers exploit Google Ads and other search engine ad tracking to distribute malware, posing a significant threat to cybersecurity.