Biggest Scam Ever Targets Google Users – How to Spot It!

Cybercriminals are more cunning than ever. Even as online vigilance reaches its peak, they manage to bypass security measures and go undetected. A newly discovered malicious advertising campaign, identified by experts at Malwarebytes Labs, is particularly alarming.

This campaign exploits Google Ads, a service that is supposed to be trustworthy, to disseminate ads that lead users to phishing sites. There, victims are prompted to log in with their Google account credentials. By doing so, they inadvertently give hackers access to their accounts, allowing them to hijack advertising revenues and even take over the Google Ads profile.

Specifically, the advertisement that might catch the targeted user’s attention appears normal at first glance, displaying a seemingly regular URL. Consequently, victims have no reason to suspect anything. However, once the user logs onto a fraudulent site and enters their credentials, the criminals gain control of the account. They then create a new Google Ads account in the victim’s name and redirect the earnings to themselves. Worse still, they often lock the legitimate owner out of their own account. The ultimate goal of these fraudsters is to sell the stolen accounts on the dark web and launch additional phishing campaigns. Malwarebytes Labs has identified several phishing operations linked to this scam across various regions including Portugal, Brazil, Hong Kong, and Eastern Europe, highlighting its global reach.

To avoid falling into this trap, always check the URL of the sites you visit, even if the advertisement appears legitimate. If a site asks you to log in with your credentials, make sure it is an official site. If in doubt, it’s safer to leave the page and search for the service directly through Google. Also, consider using a password manager, which can alert you if you’re entering your credentials on a suspicious site. If you manage a Google Ads account, pay extra attention to any unusual activities and enable two-step verification to enhance the security of your accounts. The key takeaway is to remain vigilant.