Malvertising News! Cybercriminals are using trusted Google domains to spread malicious code, and a Vietnam-based hacking group is using fake AI video generator websites to spread malware. Read on for the full story on these scams and how to avoid them.
Cybercriminals use Trusted Google Domains to Spread Malicious Code
Cybercriminals are using a sophisticated malvertising scheme that turns legitimate e-commerce websites into phishing traps. The attack leverages Google API integrations, specifically exploiting the outdated JSONP (JSON with Padding) technique, to inject malicious scripts into trusted websites.
How does it work?
Shoppers are directed to real and reputable stores that specialize in luxury goods like Ray Ban’s.
Hidden malicious scripts, delivered via legitimate Google API JSONP calls (e.g., from translate.googleapis.com or accounts.google.com), then redirect these shoppers to fraudulent payment pages.
These fake payment pages trick users into revealing their credit card information, therefore making it easy for Malvertisers to clear end users’ bank accounts. This scheme is incredibly hard to detect because they are using legitimate websites with authority and credibility, exploiting companies’ existing marketing efforts for traffic without needing their distribution, and the end user may not be able to trace back to which site or transaction caused the breach.
Malvertising News: Hackers use fake AI video generators to spread Malware
A Vietnam-based hacking group, identified as UNC6032, is using fake AI video generator websites to spread malware. The group creates fraudulent websites mimicking legitimate AI tools (like Luma AI, Canva Dream Lab, Kling AI) and promotes them through malicious ads on social media platforms such as Facebook and LinkedIn. Victims are typically directed to these fake sites, and upon attempting to generate a video, they are served a malware strain called STARKVEIL, designed to steal information and create backdoors. Other malware strains collect information about the victim’s device and anti-virus software.
How have fake AI video generators impacted end users?
The campaign has been active since mid-2024, but has only just been discovered. The campaign has been impacting millions of users globally, with a reach of 2.3 million users in the EU alone through Facebook ads in the last year. The malware exfiltrates login credentials, cookies, credit card data, and Facebook information.
Detection and Mitigation of fake AI video generators:
Google’s Mandiant unit has been tracking the campaign since November and collaborated with Meta to remove malicious ads, domains, and accounts. Meta’s Ad Library, a tool mandated by the EU’s Digital Services Act, aided in the research. But, Google warns that these “well-crafted fake ‘AI websites’ pose a significant threat to both organizations and individual users,” as the allure of new AI tools can easily lead anyone to become a victim, especially when the apps are boasting better free use models than some bigger AI tools in the industry.
How can I avoid Malvertising scandals?
Even robust Content Security Policies often fail to block these attacks because trusted domains, such as Google’s, are typically whitelisted. Continuous vigilance and proactive monitoring for suspicious script injections are crucial to protect users and maintain the integrity of legitimate online platforms. If you are a Publisher or an Ad Network, looking to maintain your brand reputation, serve clean and compliant content, as well as protect user experience and online safety on your platform or website, try AdSecure (opens in a new tab). We offer 360-degree monitoring and protection for your ad supply chain by automating your ad verification process before ad campaigns go live & while they are running. Ready to level up your cybersecurity? Get in touch with our team or start a free 14-day trial now (opens in a new tab) to see how AdSecure can help you protect your brand.
