Scammers and Cybercriminals Impersonate Brands Using Search Engine Scam Ads/Advertisement Services to Defraud Users

75% of Top Brands Fall Victim to Fraud in Google Search Ads*

The FBI has issued a warning about a growing scam where cybercriminals use fake search engine ads/advertisement services to impersonate well-known brands.

This method involves purchasing advertisements that appear prominently in search engine results, impersonating or mimicking legitimate business websites.

These fraudulent ads lead users to malicious sites that, in many cases, look identical to the real ones, where they may unknowingly download malware or provide sensitive login credentials and financial information.

Here’s a closer look at how this scam works and tips to recognize fake search engine ads.

How These Scams Work

Scammers have become adept at exploiting ad networks, including those operated by major companies like Google, to purchase advertisements that appear in search results.

These criminals create fake ads that lead to fake websites that closely mimic legitimate businesses and services. By using domains that are deceptively similar to those of real companies, they craft convincing ads that blend seamlessly with genuine search results.

These ads are then bought through automated platforms, even with stringent verification processes they appear to be real companies themselves, allowing them to bypass initial screening or pass a background search. Once these ads are live, unsuspecting users can easily be directed to fraudulent sites where they risk downloading malware or providing sensitive financial information (phishing.)

The ease of accessing and utilizing these ad networks enables scammers to reach a wide audience quickly, making their deceptive tactics highly effective and increasingly prevalent.

What They Do

Ad Purchase and Placement: Cybercriminals purchase ads through search engine advertisement services, ensuring they appear at the top of search results. These ads are crafted to look like legitimate business links, with domains similar to those of the actual companies.

Fake Webpages: Clicking on these ads directs users to counterfeit websites that are nearly identical to the official sites they are impersonating. These fake sites may offer software downloads or request login and financial information.

Malicious Downloads: When users attempt to download software from these fake pages, they unknowingly download malware instead. The download page looks genuine, and the malware is often named after the intended software, making the deception even more convincing.

Credential Theft: In cases involving financial websites, particularly cryptocurrency exchanges, the fake sites prompt users to enter their login credentials and financial details. This information is then used by criminals to steal funds and compromise accounts.

According to AdLock

Google’s moderation has gotten pretty poor: outright scams began to slip into advertisements in search results. For example, googling “check the balance of a Target gift card”, one would find a phishing link prompting them to enter the gift card data as the first result. What’s more interesting is that the link leads to the legitimate domain of the van rental company, but the site is apparently hacked. The phishing form is located in one of the subdirectories — when accessing the site directly, nothing suspicious is displayed.

According to the U.S. FBI

Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users

The FBI is warning the public that cyber criminals are using search engine advertisement services to impersonate brands and direct users to malicious sites that host ransomware and steal login credentials and other financial information.

METHODOLOGY

Cyber criminals purchase advertisements that appear within internet search results using a domain that is similar to an actual business or service. When a user searches for that business or service, these advertisements appear at the very top of search results with minimum distinction between an advertisement and an actual search result. These advertisements link to a webpage that looks identical to the impersonated business’s official webpage.

In instances where a user is searching for a program to download, the fraudulent webpage has a link to download software that is actually malware. The download page looks legitimate and the download itself is named after the program the user intended to download.

These advertisements have also been used to impersonate websites involved in finances, particularly cryptocurrency exchange platforms. These malicious sites appear to be real exchange platforms and prompt users to enter login credentials and financial information, giving criminal actors access to steal funds.

While search engine advertisements are not malicious in nature, it is important to practice caution when accessing a web page through an advertised link.

Example Fake Scam Ad

–

Fake Fraud/Scam Google Search Ad

–

Tips to Recognize Fake Search Engine Ads

Examine the URL: Always double-check the URL of the website before clicking on an ad. Look for subtle misspellings or extra characters that can indicate a fraudulent site. Sadly, this is not always possible, so make sure you have a browser security plugin.

Use Bookmarked Links: For important transactions, such as banking or cryptocurrency exchanges, use bookmarked links rather than relying on search engine results. Or search for the name of the institution and let the search engine give you the official site, but always avoid ‘ad’ or ‘sponsored’ results.

Beware of Too-Good-To-Be-True Offers: Be cautious of advertisements that offer deals or promotions that seem too good to be true. These can often be bait to lure users into clicking on malicious links.

Ad Disclosures: Look for disclosures like “Ad” or “Sponsored” that identify paid advertisements. While not all ads are malicious, this can help you distinguish between organic search results and paid promotions.

Direct Visits: Whenever possible, type the URL of the website directly into the browser rather than clicking on search engine ads. This practice reduces the risk of being redirected to a fraudulent site. But be careful here also, because you can mistype and it can take you to a criminal version of the real website.

Security Software: Use up-to-date security software both on your device and as a browser plugin to help detect and block malicious sites and downloads.

For Businesses

The FBI recommends businesses take the following precautions:

Use domain protection services to notify businesses when similar domains are registered to prevent domain spoofing.

Educate users about spoofed websites and the importance of confirming destination URLs are correct.

Educate users about where to find legitimate downloads for programs provided by the business.

Summary

With the increasing sophistication of cyber criminals, it’s crucial to remain vigilant when navigating the web. The use of search engine advertisement services to impersonate brands is a particularly insidious method, as it preys on users’ trust in prominent search results. By being aware of these tactics and practicing safe browsing habits, users can better protect themselves from falling victim to these scams. Stay informed, stay cautious, and always verify before you click.

REALITY CHECK

The Age of Poor Scammers is Long Over!

You will need to forget the outdated stereotype of scammers as poor individuals working in isolation. Today’s cyber criminals operate within highly organized, sophisticated networks, often resembling corporate entities.

These modern scam operations have significant financial resources, access to advanced technologies, and employ skilled professionals who specialize in various aspects of cybercrime. They invest heavily in research and tools to craft effective scams, leveraging detailed knowledge of social engineering, target audience weaknesses, and psychological techniques to maximize their effectiveness.

While it is true that there are still small groups of Yahoo Boys running around in Africa, these well-funded organizations run complex schemes that target individuals and businesses worldwide, using tactics that can bypass traditional security measures. They exploit the latest tools and software to create fake websites, purchase search engines and major website ads, and harvest sensitive information.

However, even the lower-level Yahoo Boys are using technology, getting training, and buying outsourcing that they never would have just 10 years ago.

The scale and professionalism of these operations mean they can quickly adapt to new security protocols and continuously refine their methods to stay ahead of law enforcement. Recognizing the true nature of these sophisticated criminal enterprises is important for the public and scam victims, as it underscores the importance of staying informed and adopting robust online safety practices.

PLEASE SHARE SO OTHERS WILL KNOW