Malvertising campaign MasquerAds abuses Google Ads

Experts warn of a new Malvertising Campaign abusing Google Ads that targets users searching for popular software.

Guardio Labs researchers uncovered a malvertising campaign, tracked as MasquerAds and attributed to a threat actor known as Vermux, that is abusing Google Ads to target users that are searching for popular software.

The campaign aims at delivering tainted versions of popular software that deploy malicious payloads on the user’s machine, including info-stealing malware such as Raccoon Stealer and Vidar.

The threat actors behind this campaign used domains with typosquatted names that appeared on top of Google search results.

The attacker used a set of benign sites, which were designed to trick visitors into clicking on them, and then redirect them to rogue sites.

“The trick is simple — creating a benign site to be promoted with the wanted keyword and keeping it valid and safe in the eyes of the policy enforcer.” reads the analysis published by Guardio Labs. “Yet, the moment those “disguised” sites are being visited by targeted visitors (those who actually click on the promoted search result) the server immediately redirects them to the rogue site and from there to the malicious payload — usually also hiding inside reputable file sharing and code hosting servers like GitHub, dropbox, discord’s CDN, etc.”

Some of the software that was impersonated by the threat actors are Grammarly, Malwarebytes, Afterburner, Zoom, Slack, Brave, and Tor.

Threat actors put a significant effort into the malicious payload employed in the campaign, for example, they employed stealers that are able to avoid defense solutions. 

“Even for Virus-Total, it took several days since our submission to get more than a few heuristic detections” continues the report.

Vermux deployed hundreds of domains and its servers were located mostly in Russia, while the rogue ads mainly targeted users in USA and Canada.

“This “masquerAd” concept is simple yet does exactly what those actors need — abuse the trust we sometimes blindly give to Google and their promoted search results. Adding to the above, the abuse of reputable file-sharing services as well as well-known software brands make them evade even the most advanced EDRs on the market. It’s inevitable to apply a more behavioral and unbiased protection level — even for the plainest and most common action like googling something up…” concludes the report, which also includes Indicators of Compromise. “Don’t get fooled by misspelled domain names, and always double-check where you download your files from!”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Malvertising Campaign)