New Delhi, October 22: A malvertising campaign has emerged that takes advantage of Google Ads to direct users searching for popular software to fictitious landing pages and distribute next-stage payloads, a new report has found. According to the cybersecurity company Malwarebytes, the malvertising campaign is "unique in its way to fingerprint users and distribute time-sensitive payloads".

The attack targets users searching for Notepad++ and PDF converters with fake ads on Google search. These ads take users to a decoy site after filtering out bots and unwanted IP addresses. The victim is redirected to a fake website advertising the software, while silently fingerprinting the system to determine if the request is originating from a virtual machine. Cyberattacks: Vietnam-Based Hackers Target Digital Marketing Firms in India, US and UK With Potential Malware by Hijacking Facebook Business Accounts, Says Report.

Users who fail the security check are redirected to the legitimate Notepad++ website. Potential targets are assigned a unique ID for tracking and to make each download unique and time-sensitive, according to the report. The final-stage malware establishes a connection to a remote domain ("mybigeye[.]icu") on a custom port and serves follow-on malware through an HTA payload.

"Threat actors are successfully applying evasion techniques that bypass ad verification checks and allow them to target certain types of victims," said Jerome Segura, director of threat intelligence, Malwarebytes. Cisco Cyber Attack: Tens of Thousands of Cisco Devices Compromised After Cyber Criminals Exploit Vulnerability in Company's Networking Software.

"With a reliable malware delivery chain in hand, malicious actors can focus on improving their decoy pages and craft custom malware payloads," he added. Users who land on the decoy site are tricked into downloading a malicious installer, which then executes FakeBat (a.k.a EugenLoader), a loader designed to download additional malicious code, the report noted.

(The above story first appeared on LatestLY on Oct 22, 2023 04:40 PM IST. For more news and updates on politics, world, sports, entertainment and lifestyle, log on to our website latestly.com).