- Researchers discovered hackers creating phishing pages on Google Sites
- The pages are then advertised on Google Ads
- Victims are locked out of their accounts, which are either used or sold
Cybercriminals have found a way to abuse and impersonate Google, run malicious ads on the search engine’s ad network, and steal login credentials from people who want to promote their businesses.
The warning comes from cybersecurity researchers at Malwarebytes, who warned users to be careful even when clicking on ads that come from Google itself.
The threat actors start by creating a fake Google Ads homepage on Google Sites, the company’s website builder, which also provides users with a Google URL (something like https://sites.google.com/view/sitename) – then they create a fake ad, communicate a campaign or a new deal and place it on the Google Ads network.
Three threat actors
“You can’t actually show a URL in an ad unless your landing page (final URL) matches the same domain name. While it’s a rule meant to protect against abuse and impersonation, it’s one that’s very easy to get around bypass,” explained Jérôme Segura, Senior Director of Research at Malwarebytes.
“Looking back at the ad and the Google Sites page, we see that this malicious ad does not strictly violate the rule, since sites.google.com uses the same root domains ads.google.com. In other words, it is allowed to serve this URL in the ad so that it cannot be distinguished from the same ad published by Google LLC.”
Victims who fall for the trick and click on the ad are redirected to a web page asking them to log in. When they do, the phishing site collects their login information, unique identifiers and cookies and forwards the data to the attackers, who then log in from a separate Google account.
The final step is to lock the victim out of their account and use it to fund additional campaigns, purchase other services, and more.
Malwarebytes believes that at least three threat actors are currently implementing this tactic: a Brazilian group, an Asian-based attacker, and a group from somewhere in Eastern Europe.
Via Bleeping Computer
