Don’t Be Fooled! Hackers Exploit Fake Google Authenticator Ads to Spread Malware

Todaysgist.com, Jakarta – Internet users must be careful with ads that appear on search pages. Recently, cybercriminals created fake Google Authenticator ads to trap victims.

Recently, hackers have placed DeerStealer malware ads disguised as Google Authenticator on Google’s advertising platform, which has the potential to deceive users.

For years, malicious advertising campaigns (malvertising) has targeted Google’s search platform, where threat actors place ads to mimic well-known software sites and install malware on visitors’ devices.

In the current action, the perpetrators are able to create ads on Google search that display official domains. As a result, victims will think the fake ads are official.

Quoting Malwarebytes report via Bleeping ComputerFriday (2/8/2024), cybercriminals threatened to create advertisements displaying Google Authenticator advertisements when users searched for the software on Google search.

To further convince the victim, the perpetrator created the advertisement by displaying ‘google.com’ and ” as a clickable URL. In fact, this is not allowed when a third party creates the advertisement.

Malwarebytes noted that advertisers’ identities are verified by Google, indicating another weakness in the ad platform being abused by threat actors.

Google told BleepingComputer it blocked fake advertisers reported by Malwarebytes.

“The perpetrators avoided detection by creating thousands of accounts simultaneously and using text manipulation, and were hidden to deceive reviewers and the website’s automated systems from being seen by normal visitors,” Google said.

Once they land on the fake Google Authenticator page and click the download button, victims unknowingly run the DeerStealer information-stealing malware.

It is said that the DeerStealer malware has the ability to steal credentials, cookies, and other information stored in the user’s web browser.

It is a good idea to make sure that the URL you are using matches the official domain of the project before downloading the file. Also, always scan the downloaded file with the latest antivirus before running it.