# Criminals Exploit Advertiser Accounts Through Fake Google Ads

## **Summary**

Researchers have recently discovered that cybercriminals are targeting individuals and businesses using Google Ads by phishing for their credentials through fraudulent ads. The scheme involves impersonating Google Ads, redirecting victims to fake login pages, and stealing advertiser accounts. The stolen accounts are likely resold on blackhat forums, while the attackers retain some to continue these campaigns.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1737376961993/48d5408b-fa7e-4175-8985-20ef01a1357a.png align="center")

## Technical Detail

Advertisers constantly compete to outbid each other for ad space on the world's leading search engine. Researchers initially stumbled upon suspicious activity linked to Google accounts, and a closer investigation revealed it was tied to malicious ads promoting Google Ads itself.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1737377008910/3734b1be-e4fe-4ab5-99d2-6f05fff6da39.png align="center")

Clicking the 3-dot menu to view more information about the advertiser displayed the victim's name, revealing it was not Google. Instead, it was one of the many compromised accounts being exploited to deceive additional users.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1737377029148/213d69a1-428b-45cb-8c8d-bd6205be14a2.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1737377047332/5ee8416b-2628-4428-846b-58f15c4ea79c.png align="center")

When victims click on these fraudulent ads, they are redirected to a page resembling the Google Ads homepage but oddly hosted on Google Sites. These pages serve as gateways to external websites crafted to steal the usernames and passwords of targeted advertisers' Google accounts.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1737377071569/d813f79d-aca5-4fb3-b3d2-bfdde782da4d.png align="center")

  
After victims click the “Start now” button on the Google Sites page, they are redirected to another site containing a phishing kit. JavaScript code fingerprints users as they proceed through each step, ensuring that all critical data is covertly collected.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1737377089672/59ba35c0-db93-4ec4-8f2c-8692229e02b9.png align="center")

Finally, all the data, including the username and password, is combined and sent to a remote server via a POST request. Researchers have observed that the criminals also receive the victim's geolocation, pinpointing the city and internet service providers.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1737377114348/57579387-b3ed-4dcf-8ee4-7ad3a52d8ec2.png align="center")

Researchers have identified two main groups of criminals running this scheme. The more prolific group consists of Portuguese speakers, likely operating from Brazil, while the other group is Chinese.

## Conclusion

As fraudulent ads remain a growing threat, researchers advise users to be especially cautious with sponsored results. Ironically, individuals and businesses running ad campaigns often avoid using ad-blockers to view their ads and those of competitors, making them more vulnerable to these phishing schemes.