During the last few months, some abused Google Ads distributed different types of malware. Although this might not be the first time, it is for sure not the last one.
We will let you know how this was possible and how to protect yourself. Read on to learn the safety measures you should take.
Abused Google Ads. How did this happen?
Using ads to trick users into downloading malware is not a new method for hackers. They use it all the time.
Usually, they interfere with the ad delivery systems, in order to place their misleading ads on different websites. These hide links to malicious pages or directly to downloads that hide malware.
Still, as Google is a giant and benefits from very strong security measures, it might be difficult to understand the situation.
But here it is how this was possible. According to Elastic Security Labs, the research community discovered an important spike in malvertising attacks, since the beginning of the year.
The result of the attacks was that users downloaded an unknown hidden virtual network computing (hVNC) malware. This steals banking details by grabbing the forms, capturing the screen, or injecting legitimate websites with fake forms.
Thus, attackers gain access to the users’ PCs.
Also, at the same time, villains started a Google ads campaign, promoting illegitimate software.
To trick users easily, attackers promoted products from well-known security companies. They built fake landing pages, which mimicked very well the original websites.
Still, the call-to-action button was leading to an MSI installer. A click on the button determined the execution of malware. The program attacked Chrome’s, Edge’s, and Firefox’s extensions, allowing hackers to steal money or cryptocurrency assets.
Now, that you know how this worked, let’s see how to stay safe online.
Tips to identify fake ads and stay safe
In order to prevent being infected, it is important to keep a good cyber hygiene, all the time. For this, you need to:
- Use antivirus and anti-malware software, and keep it up to date. You can find a short list, here.
- Use network firewalls.
- Set very strong passwords.
- Use multi-factor authentication. Thus, even if villains get your passwords, they would not be able to access your accounts.
- Use end-to-end encrypted apps and services.
- Regularly back up your important files.
- Reformat your hard drives before you give up your devices.
- Use a strong password for your routers
