When you want to download a piece of software or find an answer, you will search it through Google. Over the years, the algorithm has been continuously adjusted and optimized to search results. Most of the time, you can get what you want. Some fields in Google search are provided for brands or websites that place advertisements, but now, unscrupulous people have extended their claws to this corner that everyone is not paying close attention to, trying to trick users into being deceived.
Hackers pretend to be 7-Zip, CCleaner, OBS and other well-known software to penetrate Google search ads
Hackers are creating fake websites that mimic popular and well-known open source software and spreading them maliciously through advertising fields in Google search results. At least one high-profile user in the cryptocurrency space has fallen victim to the campaign, which claims to have allowed hackers to steal digital holdings and seize control of business and personal accounts.
Last weekend, Alex, a well-known cryptocurrency figure (known as NFT God), was attacked by hackers when he clicked on the advertising field in the search results and downloaded the open live broadcast and recording software OBS because he executed an executable file containing a malicious program on the website. In Twitter, he wrote that nothing happened when he clicked on the exe file. A few hours later, the Twitter account was hacked. At this time, Alex did not know that this was just the beginning.
After clicking the link and downloading the software, I went to install.
Nothing happened when I clicked the EXE
O well, maybe streaming wasn’t for me. I’ll attempt to become Brycent 2.0 another time
— NFT God (@NFT_GOD) January 15, 2023
Soon, Alex discovered that their account on the OpenSea NFT marketplace had also been compromised, with another wallet listed as the owner of one of their digital assets. Alex then discovered that their Substack, Gmail, Discord, and cryptocurrency wallets had suffered the same fate and were taken over by hackers.
Last night my entire digital livelihood was violated.
Every account connected to me both personally and professionally was hacked and used to hurt others.
Less importantly, I lost a life changing amount of my net worth
— NFT God (@NFT_GOD) January 15, 2023
While this is not a new attack method, it seems to be used more frequently by unscrupulous actors, abusing the Google Ads platform to push websites with malware downloads in search results. Germán Fernández, a researcher at cybersecurity company CronUP Provided a list of 70 suspicious URLs, these URLs are spread through Google Ads in search results by pretending to be genuine and legitimate software websites. These websites are copies of genuine websites that either offer fake software or redirect users to another download location.
Currently, security researchers have found that the software most commonly used to place malicious ads in Google search results includes:
- 7-Zip
- Blender 3D
- Capcut
- CCleaner
- Notepad++
- OBS
- Rufus
- VirtualBox
- VLC Media Player
- WinRAR
- Putty
The researchers reported the findings to Google, which said it would review other ads and sites in the report for possible policy violations and take action if necessary. Google has now completed this work and removed the reported malicious ads. Since there is not much difference between the advertisements in Google search results and the real search results, it is easy for people to click on them carelessly, and it is generally believed that since there are advertisements, they should be genuine official websites. From this case, everyone must keep their eyes open to identify the authenticity of the website so as not to attract wolves into the house!
Source: KOCPC Chinese