Welcome to the first News update of the year: The January 2025 Malvertising News Update edition! Join us in exploring 3 different cybersecurity attacks targeting Google Advertisers, a new Malvertising technique called Double-Clickjacking, and how Mobile Malware campaigns target crypto platforms. Read to find out!
New Malvertiser attack targets Google Advertiser accounts: How to keep Advertiser accounts safe from fake Google attacks
First off on this January 2025 Malvertising News Update, a new malicious campaign is targeting Google’s advertising platform (opens in a new tab), posing a serious danger for the platform’s Advertisers, which makes it extremely necessary to find specialized software to keep Advertiser accounts safe from fake Google attacks. In order to launch the attacks, Malvertisers are using fake Google Ads login pages to steal the Advertisers’ credentials, which they then use to hijack their accounts.
Photo credit by Malwarebytes (opens in a new tab)
The hijacked accounts are then exploited to spread malicious ads, which redirect the victims to Google Sites hosted landing pages. These pages then lead to Phishing sites designed to capture login credentials, including two-factor authentication (2FA) codes. These codes are then used by malicious Advertisers to hijack Google Ads accounts, redirect ad budgets, and further spread the scam. The campaign takes advantage of Google Ads’ policy that allows the display URL to differ from the actual landing page URL, enabling attackers to use cloaking techniques. Techniques such as cloaking, anti-bot traffic detection, and CAPTCHA-inspired lures are employed to evade detection. The attackers also use intermediary domains with the .pt top-level domain, suggesting they may be operating from other GEOs.
This has been described as one of the largest Malvertising campaigns ever observed and has already affected thousands of Advertiser accounts globally. Despite Google’s ongoing efforts to monitor and remove malicious ads (removing over 3.4 billion ads and suspending millions of accounts in 2023), the threat persists, with attackers leveraging legitimate platforms like YouTube and SoundCloud to distribute corrupted links. If you are an Ad Network wanting to make sure to keep Advertiser accounts safe from fake Google attacks at all times, you could sign up to AdSecure and try it for free now! (opens in a new tab)
**New Double-Clickjacking Malvertising strategy detected **
Cybersecurity experts are raising alarms about a new twist on the classic clickjacking attack technique (opens in a new tab). Paulos Yibelo, a security engineer at Amazon, has uncovered a variant called “double-clickjacking,” capable of disabling security settings, deleting accounts, or even taking over existing ones. Let’s start from the basics: Clickjacking is a malicious tactic where hackers manipulate user clicks on one website to trigger unintended actions on another. For instance, a user might think they are clicking a button to navigate a site but inadvertently perform an action, such as making a purchase, on an entirely different platform.
Double-clickjacking takes this concept further by introducing an additional click. This adaptation helps attackers bypass modern browser protections that no longer deliver cross-site cookies. According to Yibelo, this seemingly minor tweak “opens the door to new UI manipulation attacks that bypass all known clickjacking protections.”
In documented cases, hackers lure victims to Phishing websites, often disguised with a standard CAPTCHA verification process. Instead of typing text or identifying objects in images, users are prompted to double-click a button to prove they are human. This new Double-Clickjacking Malvertising strategy detected by experts brings back concerns over online safety, urging Ad Networks and Website owners to invest in an effective ad security solution to keep their ad supply chain and end users protected.
**Global Mobile Malware campaigns target crypto platforms and banking apps **
For the last cybercriminal news on this January 2025 Malvertising News Update edition, a new global Mobile Malware campaign has been detected (opens in a new tab). This Mobile Malware campaigns target crypto platforms as well as over 50 mobile apps worldwide. The campaign uses two dangerous Malware families: Gigabud and Spynote. Gigabud steals banking credentials through Phishing and malicious apps, while Spynote allows attackers to take full control of infected devices, stealing data, recording media, tracking locations, and even remotely controlling devices.
Both Malware strains are distributed via coordinated Phishing websites and malicious domains, with some impersonating popular brands like Ethiopian Airlines and Vietnamese financial platforms. The Malware targets mobile banking apps to steal sensitive data, including login details and transaction histories. It also employs advanced cloaking techniques to bypass detection, using tools like Virbox to hide malicious code. This poses a significant risk not just to end users, but also to corporate security, as compromised personal devices may also expose corporate data and credentials.
Given the global scale and sophistication of the campaign, experts urge consumers and organizations to adopt real-time mobile security measures, avoid downloading apps from unofficial sources, and educate employees on safe mobile practices. Zimperium, which discovered the campaign, stresses the need for advanced on-device detection to combat such evolving threats.
Join AdSecure and keep your ad supply chain clear of online threats
As we can see above, in 2025, it continues to be of extreme importance to invest in not only a competent compliance team, but also a great ad security software to keep your ad supply chain and your end users safe from bad ads, as Mobile Malware campaigns target crypto platforms and Google targets Advertiser accounts. Get in touch with our team to learn how to keep Advertiser accounts safe from fake Google attacks and to start protecting your Ad Network or website now!
