www.malwarebytes.com Open in urlscan Pro
192.0.66.233  Public Scan

Form analysis
4 forms found in the DOM

GET https://www.malwarebytes.com/

<form role="search" method="get" class="search-form" action="https://www.malwarebytes.com/">
  <label>
    <span class="screen-reader-text">Search for:</span>
    <input type="search" class="search-field" placeholder="Type to search..." value="" name="s">
  </label>
  <input type="submit" class="search-submit" value="Search">
</form>

GET https://www.malwarebytes.com/

<form role="search" method="get" class="search-form" action="https://www.malwarebytes.com/">
  <label>
    <span class="screen-reader-text">Search for:</span>
    <input type="search" class="search-field" placeholder="Type to search..." value="" name="s">
  </label>
  <input type="submit" class="search-submit" value="Search">
</form>

GET https://www.malwarebytes.com/blog/

<form role="search" method="get" class="search-form" action="https://www.malwarebytes.com/blog/">
  <div class="labs-sub-nav__searchbar-wrap">
    <input class="labs-sub-nav__search-input" type="text" name="s" placeholder="Search Labs">
    <button class="labs-sub-nav__search-button" id="cta-labs-rightrail-search-submit-en" aria-label="Search in Malwarebytes">
      <svg xmlns="http://www.w3.org/2000/svg" width="35px" height="35px" viewBox="0 0 24 24" fill="none">
        <g clip-path="url(#clip0_15_152)">
          <rect width="24" height="24" fill="none"></rect>
          <circle cx="10.5" cy="10.5" r="6.5" stroke="#0d3ecc" stroke-linejoin="round"></circle>
          <path d="M19.6464 20.3536C19.8417 20.5488 20.1583 20.5488 20.3536 20.3536C20.5488 20.1583 20.5488 19.8417 20.3536 19.6464L19.6464 20.3536ZM20.3536 19.6464L15.3536 14.6464L14.6464 15.3536L19.6464 20.3536L20.3536 19.6464Z" fill="#0d3ecc">
          </path>
        </g>
        <defs>
          <clipPath id="clip0_15_152">
            <rect width="24" height="24" fill="#0d3ecc"></rect>
          </clipPath>
        </defs>
      </svg>
    </button>
  </div>
</form>

https://www.malwarebytes.com/newsletter/

<form action="https://www.malwarebytes.com/newsletter/" class="newsletter-form">
  <div class="newsletter-form__inline">
    <label>Email Address</label>
    <input type="email" name="email" id="cta-footer-newsletter-input-email-en" placeholder="Email Address" required="" class="newsletter-form__email">
    <input type="hidden" class="newsletter-form__pageurl" value="https://www.malwarebytes.com/blog/news/2024/07/threat-actor-impersonates-google-via-fake-ad-for-authenticator">
    <input name="source" type="hidden" value="">
    <input type="submit" value="Sign Up" class="newsletter-form__btn" id="cta-footer-newsletter-subscribe-email-en">
  </div>
  <div class="newsletter-form__validate hidden">
    <span></span>
  </div>
</form>

Text Content

Skip to content
Search
Search Malwarebytes.com
Search for:
 * Sign In
   * MyAccount sign in: manage your personal or Teams subscription >
   * Cloud Console sign in: manage your cloud business products >
   * Partner Portal sign in: management for Resellers and MSPs >

 * Personal
   
   < Personal
   
   Products
    * Malwarebytes Premium Security >
    * Malwarebytes Privacy VPN >
    * Malwarebytes Identity Theft Protection >
    * Malwarebytes Browser Guard >
    * Malwarebytes for Teams/small offices >
    * AdwCleaner for Windows >
   
   --------------------------------------------------------------------------------
   
   Find the right product
   
   See our plans
   
   Infected already?
   
   Clean your device now
   Solutions
    * Free antivirus >
    * Free virus scan & removal >
    * Windows antivirus >
    * Mac antivirus >
    * Android antivirus >
    * iOS security >
    * Digital Footprint Scan >
   
   See personal pricing
   Manage your subscription
   Visit our support page 
   
 * Business
   
   < Business
   
   BUNDLES
    * ThreatDown Bundles
    * Protect your endpoints with powerfully simple and cost-effective bundles
    * Education Bundles
    * Secure your students and institution against cyberattacks
   
   TECHNOLOGY HIGHLIGHTS
    * Managed Detection & Response (MDR)
    * Deploy fully-managed threat monitoring, investigation, and remediation
    * Endpoint Detection & Response (EDR)
    * Prevent more attacks with security that catches what others miss
    * Explore our portfolio >
   
   Visualize and optimize your security posture in just minutes.
   
   Learn more about Security Advisor (available in every bundle). >

 * Pricing
   
   < Pricing
   
   Personal pricing
   
   Protect your personal devices and data
   
   Small office/home office pricing
   
   Protect your team’s devices and data
   
   Business pricing (5+ employees)
   
   Step up your corporate endpoint security. Save up to 45%
   
   
 * Partners
   
   < Partners
   
   
   Explore Partnerships
   Partner Solutions
    * Resellers
    * Managed Service Providers
    * Computer Repair
    * Technology Partners
    * Affiliate Partners
   
   Contact Us
   
 * Resources
   
   < Resources
   
   Learn About Cybersecurity
    * Antivirus
    * Malware
    * Ransomware
   
   Malwarebytes Labs – Blog
    * Glossary
    * Threat Center
   
   Business Resources
    * Reviews
    * Analyst Reports
    * Case Studies
   
   Press & News
   Reports
   
   
   
   The State of Malware 2023 Report
   
   
   
   Read report
 * Support
   
   < Support
   
   Malwarebytes Personal Support
   
   Malwarebytes and Teams Customers
   
   ThreatDown Business Support
   
   Nebula and Oneview Customers
   
   Community Forums

Free Download
 * Sign In
   * < Sign In
   * MyAccount sign in: manage your personal or Teams subscription >
   * Cloud Console sign in: manage your cloud business products >
   * Partner Portal sign in: management for Resellers and MSPs >

Search Search
Search Malwarebytes.com
Search for:
SUBSCRIBE rss

Cybercrime


THREAT ACTOR IMPERSONATES GOOGLE VIA FAKE AD FOR AUTHENTICATOR

Posted: July 30, 2024 by Jérôme Segura

We have previously reported on the brand impersonation issue with Google ads:
users who search for popular keywords are shown malicious ads that purport to be
from an official vendor.

Not only does this trick innocent victims into downloading malware or losing
their data to phishing sites, it also erodes trust in brands and by association
in Google Search itself.

Today, we show yet another example of brand misuse, except that this one targets
Google itself. If you were trying to download the popular Google Authenticator
(a multi-factor authentication program) via a Google search in the past few
days, you may have inadvertently installed malware on your computer.

A similar distribution site and the same payload were previously reported by
sandbox maker AnyRun. In this blog post, we will reveal the missing piece at the
top of the killchain, namely the Google ad that was involved in tricking users
into visiting a decoy website.


TRUST, BUT ‘VERIFIED’?

The core issue with brand impersonation comes from ads that appear as if they
were from official sources and advertisers’ identities verified by Google. This
was the case here with this ad for Authenticator:

The truth is Larry Marr has nothing to do with Google, and is likely a fake
account. We can follow what happens when you click on the ad by monitoring web
traffic. We see a number of redirects via intermediary domains controlled by the
attacker, before landing on a fake site for Authenticator.


FAKE SITE LEADS TO SIGNED PAYLOAD HOSTED ON GITHUB

The fraudulent site chromeweb-authenticators[.]com was registered via NICENIC
INTERNATIONAL GROUP CO., LIMITED on the same day as the ad was observed.

Looking at the site’s source code, we can see the code responsible for
downloading Authenticator.exe from GitHub. Note the comments from the author in
Russian:

Hosting the file on GitHub allows the threat actor to use a trusted cloud
resource, unlikely to be blocked via conventional means. While GitHub is the de
facto software repository, not all applications or scripts hosted on it are
legitimate. In fact, anyone can create an account and upload files, which is
exactly what the threat actor did under the username authe-gogle, creating the
authgg repository that contains the malicious Authenticator.exe:

Looking at the file itself, we can see that it has been digitally signed by
“Songyuan Meiying Electronic Products Co., Ltd.” just one day before, and the
signature is still valid at the time of writing:

The malware, DeerStealer, is a kind of stealer that will grab and exfitrate your
personal data via an attacker-controlled website hosted at vaniloin[.]fun.


CONCLUSION

Threat actors have been abusing Google ads as a way to trick users into visiting
phishing and malware sites. Since the whole premise of these attacks relies on
social engineering, it is absolutely critical to properly distinguish real
advertisers from fake ones.

As we saw in this case, some unknown individual was able to impersonate Google
and successfully push malware disguised as a branded Google product as well.

We should note that Google Authenticator is a well-known and trusted multi
factor authentication tool, so there is some irony in potential victims getting
compromised while trying to improve their security posture. We recommend
avoiding clicking on ads to download any kind of software and instead visiting
the official repositories directly.

Malwarebytes blocks access to the fake Authenticator website, and we detect the
payload as Spyware.DeerStealer.


INDICATORS OF COMPROMISE

Malicious domains

vcczen[.]eu
tmdr7[.]mom
chromeweb-authenticators[.]com

Payload (stealer)

5d1e3b113e15fc5fd4a08f41e553b8fd0eaace74b6dc034e0f6237c5e10aa737

C2

vaniloin[.]fun

SHARE THIS ARTICLE



RELATED ARTICLES

Podcast


SIEM IS NOT STORAGE, WITH JESS DODSON (LOCK AND CODE S05E16)

July 29, 2024 - This week on the Lock and Code podcast, we speak with Jess
Dodson about SIEM selection, management, and proper data collection.

CONTINUE READING 0 Comments
News


A WEEK IN SECURITY (JULY 22 – JULY 28)

July 29, 2024 - A list of topics we covered in the week of July 22 to July 28 of
2024

CONTINUE READING 0 Comments
News | Scams


META TAKES DOWN 63,000 SEXTORTION-RELATED ACCOUNTS ON INSTAGRAM

July 26, 2024 - Meta has taken down a whopping number of Instagram accounts
directly involved in sextortion and more accounts aimed at training scammers

CONTINUE READING 3 Comments
Explained | News


WINDOWS UPDATE MAY PRESENT USERS WITH A BITLOCKER RECOVERY SCREEN

July 25, 2024 - After the July Microsoft update some systems boot into a
BitLocker Recovery screen. How can you find the key you need?

CONTINUE READING 13 Comments
News | Privacy


TRACFONE WILL PAY $16 MILLION TO SETTLE FCC DATA BREACH INVESTIGATION

July 24, 2024 - Prepay wireless provider TracFone has been slapped on the wrist
to the tune of $16 million for insufficient customer data protection

CONTINUE READING 0 Comments

ABOUT THE AUTHOR

Jérôme Segura

Principal Threat Researcher

Contributors

Threat Center

Podcast

Glossary

Scams

Cyberprotection for every one.

FOR PERSONAL

 * Windows Antivirus
 * Mac Antivirus
 * Android Antivirus
 * Free Antivirus
 * VPN App (All Devices)
 * Malwarebytes for iOS
 * SEE ALL

COMPANY

 * About Us
 * Contact Us
 * Careers
 * News and Press
 * Blog
 * Scholarship
 * Forums

FOR BUSINESS

 * Small Businesses
 * Mid-size business
 * Larger Enterprise
 * Endpoint Protection
 * Endpoint Detection & Response (EDR)
 * Managed Detection & Response (MDR)

FOR PARTNERS

 * Managed Service Provider (MSP) Program
 * Resellers

MY ACCOUNT

Sign In

SOLUTIONS

 * Digital Footprint Scan
 * Rootkit Scanner
 * Trojan Scanner
 * Virus Scanner
 * Spyware Scanner
 * Password Generator
 * Anti Ransomware Protection

ADDRESS

One Albert Quay
2nd Floor
Cork T12 X8N6
Ireland

3979 Freedom Circle
12th Floor
Santa Clara, CA 95054

LEARN

 * Malware
 * Hacking
 * Phishing
 * Ransomware
 * Computer Virus
 * Antivirus
 * What is VPN?

 * Twitter
 * Facebook
 * LinkedIn
 * Youtube
 * Instagram


CYBERSECURITY INFO YOU CAN’T LIVE WITHOUT

Want to stay informed on the latest news in cybersecurity? Sign up for our
newsletter and learn how to protect your computer from threats.

Email Address

English
 * Legal
 * Privacy
 * Accessibility
 * Compliance Certificates
 * Vulnerability Disclosure
 * Terms of Service

© 2024 All Rights Reserved

Select your language

 * English
 * Deutsch
 * Español
 * Français
 * Italiano
 * Português (Portugal)
 * Português (Brasil)
 * Nederlands
 * Polski
 * Pусский
 * 日本語
 * Svenska



This site uses cookies in order to enhance site navigation, analyze site usage
and marketing efforts. Please see our privacy policy for more information.
Privacy Policy
Cookies Settings Decline All Accept All Cookies



PRIVACY PREFERENCE CENTER

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
Privacy Policy
Allow All


MANAGE CONSENT PREFERENCES

STRICTLY NECESSARY

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms.    You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.

Cookies Details‎

PERFORMANCE AND FUNCTIONALITY

Performance and Functionality

These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages.    If you do not allow these cookies then
some or all of these services may not function properly.

Cookies Details‎

ANALYTICS

Analytics

These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site.    All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

Cookies Details‎

ADVERTISING

Advertising

These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites.    They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

Cookies Details‎
Back Button


COOKIE LIST



Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Decline All Confirm My Choices