Hxxps://That generated the following URL: I clicked on the ad, and it generated the following Google Ad Services URL: The top result is a Google ad for AnyDesk, which shows a legitimate URL for the official AnyDesk site. The above image shows the top search results after I typed anydesk into Google search. I've heard this technique referred to as "SEO poisoning." These ads redirect users to fake software sites based on specific search terms. Cyber criminals occasionally use SEO to direct search traffic to malicious advertisement links. Search Engine Optimization (SEO) is a technique that websites use to increase their visibility for search engines like Google. Shown above: Search results when I did a quick Google search for AnyDesk. Today's diary reviews my IcedID infection from this fake AnyDesk site. Although the Google ad showed a legitimate AnyDesk URL, it led to a fake site after I clicked the ad.
on these reports, on Wednesday, I fired up my lab environment and did a Google search for AnyDesk and got a Google ad as my top result.
This week, a new round of reports appeared about Google Ads leading to a new sites pushing IcedID. Campaigns pushing IcedID malware (also known as Bokbot) also use this method as a distribution technique (we also commonly see IcedID sent through email). Fake sites for popular software have occasionally been used by cyber criminal groups to push malware.
0 kommentar(er)
