Google has fallen victim to its own ad platform, allowing threat actors to create fake Google Authenticator ads that push the DeerStealer information-stealing malware.
In a new malvertising campaign found by Malwarebytes, threat actors created ads that display an advertisement for Google Authenticator when users search for the software in Google search.
What makes the ad more convincing is that it shows ‘google.com’ and “https://www.google.com” as the click URL, which clearly should not be allowed when a third party creates the advertisement.
We have seen this very effective URL cloaking strategy in past malvertising campaigns, including for KeePass, Arc browser, YouTube, and Amazon. Still, Google continues to fail to detect when these imposter ads are created.
Malwarebytes noted that the advertiser’s identity is verified by Google, showing another weakness in the ad platform that threat actors abuse.
When the download is executed, it will launch the DeerStealer information-stealing malware, which steals credentials, cookies, and other information stored in your web browser.
Users looking to download software are recommended to avoid clicking on promoted results on Google Search, use an ad blocker, or bookmark the URLs of software projects they typically use.
Before downloading a file, ensure that the URL you’re on corresponds to the project’s official domain. Also, always scan downloaded files with an up-to-date AV tool before executing.
Unfortunately true. Support sites you love through purchases, subscriptions, and donations. Ads are, at best, a vector of mental malware. At worst, a vector of actual malware.
The issue is, that people always say this but then people don’t donate.
People have server costs and living costs and ads are realistically the only way to contribute to those. I always swing €5 here and there to developers whos apps I use often but most people don’t: look at the Ko-fi page of small devs and they probably have less than €50 total, That’s a couple months of server costs probably.
See!!! I knew this shit was gonna happen. Check out my post from a while back - on chrome and edge, when you hover over the links, they resolve instead of showing you the top link.
This means they can setup infra and evade scanning to redirect probes to legit sites like retailers, bank homepages, etc.
I feel like if they’re dumb enough to google search for amazon instead of just typing amazon.com then this is far from the only scam they’re falling for.
Urgh I hate apple. Can’t choose something else but these default options. And I have to use the safari browser because it is the only one that has the accomodations for my disability I need.
(replying from my alt cuz image hosting is down on blahaj.zone)
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
We prefer posting about open-source software whenever possible.
No soliciting engagement: Don’t ask for upvotes, follows, etc.
Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
Be civil, no violence, hate speech. Assume people here are posting in good faith.
Don’t repost topics which have already been covered here.
News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
No misinformation: Extraordinary claims must be matched with evidence.
Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
Always use an adblocker. Never disable it for any website regardless how much you like it. If they want to show you ads, they don’t like you.
For PC: https://ublockorigin.com
For mobile: https://adguard.com
Unfortunately true. Support sites you love through purchases, subscriptions, and donations. Ads are, at best, a vector of mental malware. At worst, a vector of actual malware.
The issue is, that people always say this but then people don’t donate.
People have server costs and living costs and ads are realistically the only way to contribute to those. I always swing €5 here and there to developers whos apps I use often but most people don’t: look at the Ko-fi page of small devs and they probably have less than €50 total, That’s a couple months of server costs probably.
If Google make money from this, then why would they stop?
Also, Lemmy and markdown in general requires you to put a > on the blank lines to make a continuous quote. Reddit has taught us all wrong.
I don’t know if this worked
Let’s see
You need the > on every line you want to be in the quote format.
> Quote line><- Empty line that’s part of the quote> Continuation of the quote after the empty line^This would appear as:
See!!! I knew this shit was gonna happen. Check out my post from a while back - on chrome and edge, when you hover over the links, they resolve instead of showing you the top link.
This means they can setup infra and evade scanning to redirect probes to legit sites like retailers, bank homepages, etc.
had someone call the other day that nearly got scammed after clicking the top ‘result’ (it was an ad) on a google search for amazon.
I feel like if they’re dumb enough to google search for amazon instead of just typing amazon.com then this is far from the only scam they’re falling for.
FFS, that’s got to be by design. Like, Google recognises that you’re an easy target for scammers and directs you towards them.
I bet if you did the same search logged into your own account, or even not logged in at all, you wouldn’t get the same result.
Verified by Google == The transaction went through.
I switched permanently to duckduckgo yesterday. Couldn’t be happier.
Meh, the results have got very bad. They are mostly ads now and every damn article is provided not by its origin but msn
What is? Not DuckDuckGo?
DuckDuckGo
They also have some trackers I think. Try SearxNG.
Urgh I hate apple. Can’t choose something else but these default options. And I have to use the safari browser because it is the only one that has the accomodations for my disability I need.
(replying from my alt cuz image hosting is down on blahaj.zone)
Actually I found a way to bypass this using the “hyperweb” extension, if anyone needs in future
You did this to yourself when you bought an Apple device
They can just install another browser…
Android doesnt have the accessibility things I need at all 🤷 didnt have much of a choice.
I’m sorry you have to deal with that. And I’m sorry you don’t have a choice