Researchers have spotted yet another malicious campaign that abuses Google Ads to steal people’s sensitive data – specifically Amazon Web Service (AWS) login credentials.
Experts from Sentinel Labs recently discovered a Google Ads campaign that advertised a malicious landing page that appeared near the top of the search engine's results for the cloud giant.
People who would use Google’s search engine to search for “aws” would see, ranked second, a malicious landing page that impersonated (opens in new tab) a vegan food blog.
Categorizing stolen data
Those heading to that site would then be prompted with a fake AWS login page where, once entered, the information would be stolen.
Furthermore, the site prompted the victims to select if they are a root or IAM user, helping crooks categorize the stolen credentials based on utility and value.
The attackers also added a JavaScript function, disabling right clicks, middle mouse buttons, and keyboard shortcuts, the researchers added, speculating that the feature was included to discourage victims from easily navigating away from the landing page.
Sentinel Labs discovered the campaign on January 30, 2023, and further investigation uncovered that the attackers were most likely Brazilian.
The researchers reported the attack to CloudFlare which shut down the malicious account but BleepingComputer claims the ads on Google are still active. We weren’t able to independently verify if that is still the case, or if Google did its part in the meantime.
Cybercriminals constantly try to leverage Google’s ad network to deliver malware and steal people’s data. The search engine giant is generally perceived as trusted, making people less vigilant when clicking on search engine results. Last December, researchers from Malwarebytes spotted a campaign in which scammers used the traffic from an adult website to generate clicks on Google Ad banners, netting huge returns.
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba