Sophisticated phishing scams target advertising industry media buyers via malicious Google Ads links, allowing hackers to infiltrate accounts and misuse funds for fraudulent advertising campaigns.
- Criminal gangs around the world, including groups believed to be based in Brazil, Asia and Eastern Europe, place fake Google Ads links that appear legitimate in search results.
- Victims unknowingly enter their login credentials on phishing sites, giving hackers access to Google Ads accounts.
How it works:
- Bait and switch: Scammers create misleading sponsored links that imitate legitimate Google Ads login pages.
- Theft of credentials: When ad buyers click on these links and enter their login details, the scammers gain access to their account.
- Account exploitation: Hackers use stolen credentials to create phishing campaigns or serve fraudulent click-based ads, funneling advertising budgets back into their own operations.
Why it matters to us. These phishing scams can put your Google Ads accounts at risk, drain advertising budgets, and disrupt campaigns. Hackers use stolen credentials to serve fraudulent ads, damaging brand reputation and wasting resources.
Additionally, advertisers often have to detect and report the violations themselves, delaying resolution and increasing losses. Proactive security measures are critical to protecting assets and maintaining customer trust.
Details. Big budget advertising accounts are prime targets, with hackers demonstrating their expertise in disguising fraudulent campaigns as legitimate ones.
Malwarebytes estimates that thousands of Google Ads accounts have been compromised in the last few months. Affected advertisers have reported significant financial losses and disrupted campaigns.
The scam continues, and as Google investigates, new malicious ads are popping up.
What Google says. “We specifically prohibit advertising that aims to deceive people in order to steal their information or defraud them. “Our teams are actively investigating this issue and are working quickly to resolve it,” a Google spokesperson said.
However, victims report that Google’s response is often delayed, leaving them to detect and report the scam themselves.
Conclusion. Advertisers should avoid using Google Search as an entry point to log in to Google Ads and should implement stricter security measures such as two-factor authentication and direct URL access to prevent future breaches. The scams underscore a broader need for increased vigilance and security in the digital advertising ecosystem.
