Vocabulary:

Malvertising:	The use of online advertisements to spread malware by embedding malicious code within ads.
Phishing:	A cybercrime technique where attackers impersonate legitimate entities to steal sensitive information like login credentials.
Sponsored Ads:	Paid advertisements that appear prominently in search engine results.
Credential Harvesting:	The act of collecting usernames, passwords, and other login information illegally
Evade Detection:	Techniques used by cybercriminals to avoid being identified by security systems.
Redirect:	Automatically sending a user from one webpage to another without their explicit action.
Lookalike Website:	A fraudulent website designed to closely resemble a legitimate site to deceive users.
Two-Factor Authentication (2FA):	A security process requiring two forms of identification before granting access to an account.
Smishing:	Phishing attacks carried out through SMS messages to trick recipients into revealing personal information.
Obfuscation:	The process of making code or content difficult to understand to hide malicious intent.
Endpoint Security:	Security measures designed to protect individual devices like computers and smartphones from threats.
Phishing-as-a-Service (PhaaS):	A service model where cybercriminals provide phishing tools and infrastructure for others to conduct phishing attacks.

Article:

Cybersecurity researchers have uncovered a sophisticated malvertising campaign designed to target Microsoft advertisers using fraudulent Google ads to direct them to phishing pages aimed at harvesting credentials.

Key Findings:

• Malicious Google Ads: Threat actors deploy deceptive ads on Google Search, specifically targeting users searching for terms like “Microsoft Ads.” These ads redirect users to phishing pages masquerading as Microsoft’s advertising platform.
• Evasion Techniques:
  • Traffic Redirection: Traffic originating from VPNs is rerouted to fake marketing websites to avoid detection.
  • Bot Filtering: Cloudflare challenges are used to filter out bots.
  • Rickrolling for Direct Visits: Users attempting to access the final landing page directly are redirected to a YouTube rickroll video, diverting suspicion.
• Phishing Infrastructure: The phishing pages mimic legitimate Microsoft login portals, designed to capture credentials and two-factor authentication (2FA) codes, enabling account hijacking.
• Geographical Insights: Many phishing domains are hosted in Brazil or use the “.com.br” TLD, similar to previous campaigns targeting Google Ads users hosted on “.pt” domains.
• Long-Term Operation: Malwarebytes identified related phishing infrastructure dating back several years, indicating an ongoing and evolving campaign possibly targeting other platforms like Meta.

Google’s Response: Google has reiterated its commitment to prohibiting deceptive ads and has suspended accounts involved in such practices.

---

USPS-Themed Smishing Attacks

In parallel, researchers have reported a large-scale SMS phishing (smishing) campaign impersonating the United States Postal Service (USPS) to target mobile device users.

Attack Details:

• Lure: SMS messages claim a failed package delivery, urging recipients to open an attached PDF to update their address.
• Malicious PDFs: The PDFs contain a “Click Update” button leading to a USPS-themed phishing site designed to steal:
  • Mailing address
  • Email address
  • Phone number
  • Payment card details (under the guise of a redelivery fee)
• Obfuscation Techniques:
  • URLs embedded without the standard /URI tag, complicating detection during security analysis.
  • Data entered on phishing pages is encrypted and sent to attacker-controlled servers.
• Scale of the Campaign:
  • Over 20 malicious PDFs and 630 phishing pages detected.
  • Indicators of a large, coordinated operation.

Advanced Social Engineering:

• iMessage Exploitation:
  • Some attacks use Apple’s iMessage to deliver phishing pages.
  • Threat actors prompt recipients to reply (e.g., “Please reply to Y”), disabling iMessage’s link protection features.
• Threat Actor: Linked to a Chinese-speaking group known as “Smishing Triad,” employing phishing-as-a-service (PhaaS) toolkits like Darcula to target postal services globally.

Expert Insight: Researchers from Huntress noted the campaign’s effectiveness due to its well-crafted social engineering techniques, making it prevalent in the wild.

These campaigns highlight the evolving tactics used by cybercriminals to exploit trusted platforms and brands. From leveraging legitimate ad networks to sophisticated smishing attacks, organizations and individuals must remain vigilant against such threats.

Questions:

What is the main goal of the malvertising campaign described in the article?

How do the attackers trick users into clicking on malicious links?

What techniques do the attackers use to evade detection?

Describe the similarities and differences between the malvertising and smishing campaigns.

How do the phishing pages capture sensitive information from victims?

Discussion Questions:

Why do you think malvertising is an effective method for cybercriminals?

How can individuals protect themselves from phishing and smishing attacks?

Do you believe two-factor authentication is enough to secure online accounts? Why or why not?

What are the ethical implications of using GenAI in cyberattacks?

Should search engines like Google be held responsible for preventing malvertising? Explain your reasoning.

This article was source from TheHackerNews