Fake Cisco Webex Google Ads abuse tracking templates to push malware
www.bleepingcomputer.com
Threat actors use Google Ads tracking templates as a loophole to create convincing Webex software search ads that redirect users to websites that distribute the BatLoader malware.

Most people know at this point that when searching for a popular software package to download, you should be very careful to avoid clicking on any of the search ads that appear, as this has become an extremely common vector for distributing malware to unsuspecting users.

If you thought that you could identify these malicious ads by checking the URL below the ad to see if it directs to the legitimate site, think again! Malware advertisers have found a way to use Google’s Ad platform to fake the URL shown with the ad to make it appear like a legitimate ad for the product when in fact, clicking the ad will redirect to an attacker controlled site serving malware.

Don’t click on search ads or, even better, use an ad-blocker so that you never see them in the first place!

  •  dan1101   ( @dan1101@lemm.ee ) 
    8•10 months ago

    Businesses should not be allowed to serve ads from random people without curating/checking them first. Yeah it would be a lot of trouble and cost a lot of money, too fucking bad you are making billions of dollars off this.

        •  ipkpjersi   ( @ipkpjersi@lemmy.ml ) 
          2•10 months ago

          It probably is a crime, but large corporations don’t have to care about crimes because they can just pay the fines and be on their way like nothing happened. It’s no more of an inconvenience to them than just a small mosquito landing on them.

          •  dan1101   ( @dan1101@lemm.ee ) 
            0•10 months ago

            If False Advertising in web/app ads started being prosecuted, the whole Internet economy would be devastated. Would probably be thousands of dollars per violation. Just think of all the scummy ads that appear on news sites or in apps. I even consider those “Download Now” button type ads to be false advertising, they are trying to look like part of the page they are served on, they don’t even tell you what you’re downloading.

            •  ipkpjersi   ( @ipkpjersi@lemmy.ml ) 
              0•10 months ago

              I think there’s a difference between scummy ads like false advertising which is obviously bad, and downright malicious software which it sounds like the ad OP is talking about serves actual malware.

              •  Ferris   ( @Ferris@infosec.pub ) 
                1•9 months ago

                You may find such things in similar contexts, though I would believe that an ad service willing to serve either would hammer you faster for malicious payloads than confusing download advertisement misdirects.

                I should probably read the article. If the title isn’t misleading, it is possible to use google referral urls as a masking service and pay for visibility on the link :/

  •  kevincox   ( @kevincox@lemmy.ml ) 
    1•10 months ago

    This has been a feature of Google Ads forever. It isn’t even “found a way” it is just a box to fill in the ad manager.

    Presumably this is so that they can use tracking links to analyze the performance of the ad without making the URL “ugly”. But it is easy to abuse. (Although I think Google attempts to do some checks, but of course those are always going to be unreliable.)

    •  drspod   ( @drspod@lemmy.ml ) OP
      1•10 months ago

      AFAIK even legitimate ad clicks will first direct to an analytics platform before redirecting to the destination site, so that they can track click through rates and where the referral came from. So it is unlikely that ad links will actually go to the website you expect them to even in normal scenarios. It is actually this mechanism that the malicious ads described in the article are using to fake the display URL.