What are the products or services that people want to buy? What do people search for on Google, Bing or Yahoo? And, what ads can seduce users of social networks such as Instagram, TikTok or YouTube? These legitimate questions, which are asked by all companies wishing to market their products via social networks or search engine advertising (SEM), are also the starting point for cybercriminals carrying out malvertising attacks.
Like many other techniques, malvertising combines social engineering tactics with various types of malware. In this sense, its name already suggests how it works: malicious actors use advertising on social networks and search engines to get citizens and companies to download a malware-infected program or file.
What are the objectives of malicious actors? Obtaining information to commit other attacks, accessing multiple types of personal or professional accounts, hijacking private data to market it, financial fraud, draining cryptocurrency wallets, taking control of infected computers…
Malvertising is a technique with enormous potential for criminals because Facebook, Instagram, or Google ads have become a constant in our daily lives and a way of marketing products and services used by millions of companies. Therefore, it is feasible that a citizen can be deceived by a malicious actor if the ad and the page to which it leads offer a semblance of legitimacy.
In the following, we will explore the keys to malvertising and examine what companies and citizens can do to combat this malicious technique.
Although it may seem trivial, a critical aspect of malvertising is the choice of the company and the service or product whose identity is to be impersonated. After all, if the advertised product does not generate interest among users, no one will click on the malicious ad.
For example, in early April 2024, several malvertising campaigns were unveiled on Facebook advertising the services of some of the world’s best-known generative AIs such as ChatGPT, DALL-E, SORA or Midjourney. How did they seduce their victims? By offering them the possibility to test new AI system updates in advance. However, behind these ads were hidden various info-stealers that allowed criminals to steal data from users’ browsers:
In addition to resorting to products and services with high social demand, we should consider another advantage of malvertising. Malicious actors can decide which people will view their malicious ads. Why? Logically, ad creation tools such as Facebook Ads or Google Ads allow companies to segment the audience of their ads so that they are shown only to their target audiences, defining aspects such as gender, age, where they live, etc.
From the hostile actors’ point of view, this is a great advantage when it comes to targeting their potential victims and also allows them to reduce the money they have to spend on ads to get clicks.
The case mentioned above shows us another key to malvertising, especially regarding social media platforms: the profiles from which the fake ads are created.
In recent years, cyber intelligence professionals have detected a phenomenon that has been gaining prominence: the hacking of social network accounts. One of the purposes of the criminals who carry out this activity is to steal profiles of real people and companies to transform them and impersonate the identities of other companies. This is precisely what the criminals in the above case did.
So, they hijacked private Facebook profiles and impersonated AI systems companies by sharing photos and information to make the pages look legitimate and not raise suspicions among the social network or the users viewing the ads.
In another recent case, hostile actors launched a malvertising campaign through YouTube, offering NFTs that don’t exist and fake discounts on cryptocurrencies, to what end? To redirect users to a web of 1,700 WordPress sites infected with crypto drainers to get their hands on their crypto assets.
Therefore, a fundamental element of most phishing campaigns is creating fake but very realistic-looking web pages to which victims are directed from advertisements. These pages are essential in malvertising because they must generate sufficient trust in the victim to make him willing to enter personal data or download programs and files.
So far, we have focused on the social engineering tactics used by criminals to allow them to find an attack vector. Once the deception is successful, malware comes into play.
The more sophisticated the malware used to infect a victim’s device, the more difficult it is to detect.
This is why the most advanced criminal groups continually design new malware and innovate their techniques, tactics and procedures (TTPs). For example, at the end of 2023, BlackCat, one of the most famous global cybercriminal groups, launched a malvertising campaign using Google Ads. To do so, it designed fake ads offering professional and business software. As a result, some company employees took the bait, downloaded malware and provided BlackCat with access to corporate systems.
As a result, BlackCat was able to infect multiple companies’ IT infrastructure using initial access malware that could hide and go undetected and then ransomware to steal their data and demand a ransom in exchange for its return.
As we have just pointed out, malvertising attacks can reach a high level of sophistication, consume a large amount of financial resources and require months of work before the criminals can achieve their malicious goals and monetize the attacks.
Does this mean only criminal groups with more significant resources, knowledge, and experience can launch malvertising campaigns? Unfortunately, not. The expansion of Phishing-as-a-Service and Malware-as-a-Service models has resulted in thousands of small criminals being able to launch sophisticated attacks using social engineering and malware, including malvertising attacks.
In addition, the increasing sophistication of generative AIs can help malicious actors develop fraudulent pages, generate fake images, text and videos, or even build code.
Let’s move from the attackers to the companies and citizens who are affected by malvertising:
Search engines and social networking platforms must strengthen their security protocols to prevent malicious actors from taking control of actual user pages and creating fraudulent ads. They must also have comprehensive cyber intelligence services to help prevent fraud on their platforms.
Threat Hunting services can also be crucial in uncovering and understanding the most innovative TTPs of criminal groups and taking a proactive approach in the fight against fraud.
Otherwise, they will see their credibility damaged to the point where users will no longer trust the ads, which would be a significant crisis in their business models, as ads are one of their primary sources of revenue.
Malvertising is also a big problem for companies whose identities are impersonated for criminal purposes. Not only does it damage their brand image, but it can also discourage users from clicking on the legitimate ads they offer on social networks and search engines. This is critical for companies that rely heavily on SEM and social media to capture leads and generate digital sales.
For this reason, organizations must have cyber intelligence experts who provide them with fraud prevention and anti-piracy services online. Thanks to these services, social engineering campaigns that impersonate companies’ identities and the dissemination of fake products and services can be detected.
Individual citizens can avoid becoming victims of malvertising by exercising caution and common sense. In addition, some indications allow individuals to be wary. For example, if a web page to which an advertisement redirects presents a strange URL that is not consistent with the web network of the advertising company.
Beyond this, companies must consider that their professionals can be victims of malvertising when designing their cybersecurity strategies. They also have at their disposal various cybersecurity services that can be key to preventing malvertising attacks and, should they occur, detecting the presence of malware and responding to malicious actions quickly and effectively:
In short, malvertising is a fraudulent practice that can cause significant damage to social media platforms, web search engines and thousands of companies and enterprises, regardless of their size. Therefore, it is essential to be aware of this technique that combines social engineering and malware to obtain confidential information and commit fraud and scams against companies and citizens.
Edutech Life is an ideology, a lifestyle, which makes sure that every career is fueled with the right tools. Be it getting proper guidance on the various Career tracks or how to follow the proper career steps or even upgrading on to a higher position.