Malicious Google Ads found promoting a fake IP scanner that just wants to steal your data

Ransomware
Image credit: Shutterstock (Image credit: Shutterstock)

Security researchers have spotted another malicious advertising campaign in Google Ads that sees hackers impersonating multiple legitimate software companies. 

While definitely not the first of its kind, this campaign was said to be unique for distributing a sophisticated Windows backdoor.

The campaign was first spotted by cybersecurity researchers from Zscaler Threat labs, who noted between November 2023, and March 2024, unidentified threat actors registered at least 45 domains. All of them were typosquatted versions of port scanning and IT management software companies, such as Advanced IP Scanner, Angry IP Scanner, IP scanner PRTG, and ManageEngine.

New malware

Then, they somehow managed to create an ad campaign on Google Ads to promote these sites. Usually, hackers would do it by obtaining access to a legitimate Google Ads account, possibly one with a proven track record of “clean” ads. 

Consequently, whoever would search for this type of software on Google would be presented with these ads in the top of the search engine results page, as well as in other locations reserved for ads. Those who would open the site, and download the programs offered there, would end up getting the MadMxShell backdoor.

This backdoor, The Hacker News reports, is a brand new piece of malware. Its infection chain is relatively long, and includes multiple DLL and EXE files. 

"The backdoor uses techniques such as multiple stages of DLL side-loading and DNS tunneling for command-and-control (C2) communication as a means to evade endpoint and network security solutions, respectively," the researchers explained.

"In addition, the backdoor uses evasive techniques like anti-dumping to prevent memory analysis and hinder forensics security solutions."

So far, the researchers don’t know who the attackers are, or what their motives for the campaign might be. A backdoor has numerous use cases, from data theft and espionage, to unauthorized access, setting up persistence, and even remote control.

More from TechRadar Pro

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Mac users targeted with new malware, so be on your guard
Fraude en ligne phishing
Google Search ads are being hacked to steal account info
Representational image of a cybercriminal
Criminals are spreading malware disguised as DeepSeek AI
A padlock resting on a keyboard.
Understanding and avoiding malvertizing attacks
malware
Google warns of legit VPN apps being used to infect devices with malware
DeepSeek
Fake DeepSeek installers are infecting your device with dangerous malware
Latest in Security
Isometric demonstrating multi-factor authentication using a mobile device.
NCSC gets influencers to sing the praises of 2FA
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Dangerous new CoffeeLoader malware executes on your GPU to get past security tools
China
Notorious Chinese hackers FamousSparrow allegedly target US financial firms
A digital representation of a lock
NYU website defaced as hacker leaks info on a million students
NHS
NHS IT supplier hit with major fine following ransomware attack
Businessman holding a magnifier and searching for a hacker within a business team.
Cloud streaming hoster StreamElements confirms data breach following attack
Latest in News
cheap Nintendo Switch game deals sales
Nintendo didn't anticipate that Mario Kart 8 Deluxe was 'going to be the juggernaut' for the Nintendo Switch when it was ported to the console, according to former employees
Three angles of the Apple MacBook Air 15-inch M4 laptop above a desk
Apple MacBook Air 15-inch (M4) review roundup – should you buy Apple's new lightweight laptop?
Witchbrook
Witchbrook, the life-sim I've been waiting years for, finally has a release window and it's sooner than you think
Amazon Echo Smart Speaker
Amazon is experimenting with renaming Echo speakers to Alexa speakers, and it's about time
Shigeru Miyamoto presents Nintendo Today app
Nintendo Today smartphone app is out now on iOS and Android devices – and here's what it does
Nintendo Virtual Game Card
Nintendo reveals the new Virtual Game Card feature, an easier way to manage your digital Switch games