To evade detection, the threat actors deploy techniques like rerouting VPN-originated traffic to a fake marketing website and using Cloudflare challenges to filter out bots
Cybersecurity researchers have uncovered a sophisticated malvertising campaign aimed at Microsoft advertisers, with fraudulent Google ads designed to lure users to phishing pages capable of stealing their login credentials.
Jérôme Segura, Senior Director of Research at Malwarebytes, said the malicious ads “are designed to steal the login information of users trying to access Microsoft’s advertising platform.”
The discovery comes weeks after Malwarebytes exposed a similar campaign targeting individuals and businesses using Google’s advertising services.
The latest attack targets users searching for terms like “Microsoft Ads” on Google. Threat actors serve malicious sponsored links that appear legitimate but direct users to counterfeit pages mimicking Microsoft’s advertising platform. The fake page, “ads.mcrosoftt[.]com,” is crafted to capture login credentials and two-factor authentication (2FA) codes.
Interestingly, users who directly access the phishing site are redirected to a YouTube video featuring the infamous Rickroll meme, a tactic to dissuade investigation.
To evade detection, the threat actors deploy techniques like rerouting VPN-originated traffic to a fake marketing website and using Cloudflare challenges to filter out bots. Malwarebytes also noted that many phishing domains are hosted in Brazil or have “.com.br” extensions, drawing comparisons to similar campaigns targeting Google Ads users in “.pt” domains.
Microsoft Advertising Not Alone
Malwarebytes suggested that the campaign has likely been running for years and may have targeted other advertising platforms, including Meta.
While Google has yet to provide an updated comment, it previously stated that it takes steps to block ads aimed at stealing user information and enforces countermeasures against such threats.
USPS-Themed Phishing Scams Target Mobile Users
In a separate development, security researchers from Zimperium zLabs have identified a large-scale SMS phishing (smishing) campaign impersonating the United States Postal Service (USPS).
The attack begins with an SMS claiming a failed package delivery and prompts recipients to open an attached PDF to update their address. The document contains a “Click Update” button leading to a phishing page designed to capture personal information, including mailing addresses, phone numbers, and payment card details.
Fernando Ortega, a researcher at Zimperium zLabs, described the campaign as employing “sophisticated social engineering tactics and a never-before-seen means of obfuscation to deliver malicious PDF files designed to steal credentials and compromise sensitive data.”
The phishing page encrypts and transmits the stolen data to a remote server. Researchers have detected around 20 malicious PDFs and 630 phishing pages linked to the operation.
Notably, the scammers bypass iMessage’s built-in safety features by instructing users to reply, effectively turning off phishing protection. This technique is linked to a phishing-as-a-service (PhaaS) toolkit named “Darcula,” which has targeted postal services in over 100 countries.
“The scammers have constructed this attack relatively well, which is probably why it’s being seen so often in the wild,” said Huntress researcher Truman Kain. “The simple truth is it’s working.”
These developments underline the evolving nature of cyber threats as attackers continuously find new ways to exploit users’ trust and technological vulnerabilities. Experts urge vigilance, the use of strong security practices, and immediate reporting of suspicious activity to mitigate risks.
