Google ads push fake Google Authenticator site installing malware

Google ads push fake Google Authenticator site installing malware

Information:

  Google Ads, formerly known as Google AdWords, is an online advertising platform developed by Google that allows businesses to create and manage ads on Google Search and the Google Partner Network effectively.

   Google Authenticator is an application used for two-factor authentication (2FA), making your online accounts more secure. In addition to your own password, you will also need to enter a special code generated by this app in real time.

Incident :

   Google has fallen victim to its own ad platform, allowing threat actors to create fake Google Authenticator ads that push the DeerStealer information-stealing malware. To make matters worse, threat actors have been able to create Google search ads that show legitimate domains, which adds a sense of trust to the advertisement.

   In a new malvertising campaign found by Malwarebytes, threat actors created ads that display an advertisement for Google Authenticator when users search for the software in Google search.

   What makes the ad more convincing is that it shows 'google.com' and "https://www.google.com" as the click URL, which clearly should not be allowed when a third party creates the advertisement.

Picture 1 Verified advertiser account

Malwarebytes noted that the advertiser's identity is verified by Google, showing another weakness in the ad platform that threat actors abuse and when asked how threat actors can take out ads impersonating legitimate companies, Google said that threat actors are evading detection by creating thousands of accounts simultaneously and using text manipulation and cloaking to show reviewers and automated systems different websites than a regular visitor would see. 

  However, the company is increasing the scale of its automated systems and human reviewers to help detect and remove these malicious campaigns. These efforts allowed them to remove 3.4 billion ads, restrict over 5.7 billion ads, and suspend over 5.6 million advertiser accounts in 2023.

Fake Google authenticator sites

  Clicking on the fake Google Authenticator ads take the visitor through a series of redirections to the landing page at "chromeweb-authenticators.com," which impersonates a genuine Google portal.

  Clicking on the 'Download Authenticator' button on the fake sites triggers a download of a signed executable named "Authenticator.exe" [VirusTotal] hosted on GitHub.

Picture 2 The malicious site spreading DeerStealer

The valid signature gives the file credibility on Windows, potentially bypassing security solutions and allowing it to run on the victim's device without warnings.

  When the download is executed, it will launch the DeerStealer information-stealing malware, which steals credentials, cookies, and other information stored in your web browser.

Picture 3 Valid signatures on different samples of the malware

Recommendation:

  - Users looking to download software are recommended to avoid clicking on promoted results on Google Search

  - use an ad blocker, or bookmark the URLs of software projects they typically use.  - Before downloading a file, ensure that the URL you're on corresponds to the project's official domain.

  - always scan downloaded files with an up-to-date AV tool before executing.

The important things is Security systems. We must concern and monitor as usual.
For more information please contact
Email :sales@inetms.co.th
065 149 2822 (Ms.Suphatson )
063 204 4534 (Ms.Atsamaphorn)
065 929 6330 (Ms.Kansinee)

References :

  - https://www.bleepingcomputer.com/news/security/google-ads-push-fake-google-authenticator-site-installing-malware/

  - https://insight.sosecure.co.th/news/public/news/detail/a170712f-27d2-4c1d-b5d6-aeac8b5f4435/th

  - https://www.nasdaq.com/articles/fake-google-authenticator-ads-spread-deerstealer-malware

Weekly Interesting CVE

Malware News or Campaign IOC/IOA | EN

Ref : https://www.scmagazine.com/brief/novel-dropper-leveraged-for-gh0st-rat-deployment