briefly: If you’ve got ever been redirected to a strange-looking Q&A web site that seems to be selling cryptocurrencies or different blockchain know-how, it could be a part of an advert click-pump rip-off. Since final fall, 1000’s of contaminated web sites have been caught up in these fraudulent schemes.
Security researchers at Sucuri have been monitoring malware for the previous few months that redirects customers to misleading pages to spice up Google advert impressions. The marketing campaign has contaminated greater than 10,000 web sites, inflicting them to redirect guests to utterly completely different spam websites.
Suspicious pages usually comprise question-and-answer kinds that point out Bitcoin or different blockchain-related subjects. Savvy customers may assume that these websites are attempting to promote bitcoin or different cryptocurrencies, presumably as a part of a pump and dump scheme. That will be the case, however Sucuri believes the entire textual content is simply filler content material, obscuring the rip-off’s precise income, Google advert views.
A clue to that is that lots of the URLs concerned seem within the browser’s tackle bar, as if the consumer had clicked on a Google search consequence resulting in the positioning in query. The ruse could also be an try to disguise the redirect as a click on from a Google backend search consequence, presumably boosting search impressions for advert income. However, it is unclear if this trick labored, as Google did not log any clicks on search outcomes that matched the cloaked redirect.
Sucuri first seen the malware in September, however the marketing campaign intensified after the safety group first reported it in November. In 2023 alone, researchers tracked greater than 2,600 contaminated web sites that redirected guests to greater than 70 new fraudulent domains.
The scammers initially used CloudFlare to cover their actual IP addresses, however the service activated them after the November story. They’ve migrated to DDoS-Guard, an identical however controversial Russian service.
The marketing campaign primarily focused WordPress websites, indicating a zero-day WordPress vulnerability. Additionally, malicious code may be hidden by obfuscation. It may also be quickly disabled whereas an administrator is logged in. Website operators ought to safe their admin panels with two-factor authentication and guarantee their web site’s software program is updated.
This marketing campaign is not the one latest malware drive linked to Google adverts. Malicious actors have additionally been spreading malware to customers impersonating widespread software program purposes, benefiting from Google’s advert rankings to look on the prime of search outcomes. For now, these seeking to obtain apps like Discord or Gimp ought to keep away from trying them up by Google.
