this video is brought to you by incog
stick around to hear more about the
discount they're providing to the entire
upper echelon Community okay today once
again is a security topic but the
pathway to get here was a little bit
abstract all of it began with a simple
tweet from a man named Michael girdley
this tweet on screen right now said the
following quote if I am annoyed at your
company pointing to a Google advert at
the top of the search page for slack
pricing and then different quote if I
like your company pointing to the actual
slack website itself in the same search
page the insinuation here is that
clicking on the Google advert costs the
company money whereas directly
purchasing from their website avoids
that unnecessary click fee in theory
it's a rather funny way of striking back
at corporate entities and I chuckled a
bit when I read it however that levity
was extremely shortlived because after
reading the text and flipping back to
whatever other project it is I was
working on at the time I remembered
something I remembered though I am
certainly not an expert at this point in
time just yet that something called
malvertising has recently been gaining
massive Traction in the online World
leading to an unknown number of Highly
damaging infections system infections
with Untold consequences I'll try not to
be a hyperbolic Doomer or an alarmist
right now or anything like that but
seeing this relatively popular tweet I
guess with over 2.4 million views and
12,000 likes it really made me start
thinking here's a top- down overview of
the situation for a tremendous number of
digital programs such as OBS Brave
audacity utorent grammar Le notepad MSI
afterburner blender and more the Google
sponsored Links at the top of the page
which are paid for through Google
AdWords have been infected with highly
dangerous malware a little bit more
context here even though most people
will probably know at least one of those
programs by name OBS is obviously a
program for streamers and creators Brave
is a privacy based browser client
audacity is an audio editing Suite
uTorrent is a peer-to-peer sharing
Network grammarly is for spellchecking
notepad Plus plus is a text and source
code editor MSI After Burner is
overclocking software for gaming
hardware and blender is a 3D editing
program all walks of life all types of
programs multiple user demographics and
all of them were overrun with malware
that list is actually a whole hell of a
lot longer no one has the full
comprehensive list right now because
threat actors can spin up a new version
with minimal effort proceeding to
advertise it at the top of Google search
results through their own advertising
portal but in reality these websites are
not a legitimate vendor for the software
they are fabricated pages that redirect
to a separate distribution platform like
Dropbox or Discord CDN the content
distribution network of Discord which
I've talked about previously as being a
massive Distribution Hub for malware
prompting the user to download an
infected version of whatever program
they are looking for that contains one
of many possible malware Steelers which
will harvest pretty much all sensitive
data on your machine which can then lead
to everything from loss of identity to
compromised social media accounts etc
etc it's scary stuff before going
further it's time for today's video
sponsor incog every day that you exist
online your data is being sold by
thirdparty Brokers and accessed without
your knowledge as a result of data
breaches most people may not know this
or worse yet they don't even care but
it's actually a very big concern in a
rapidly growing digital landscape
companies hold and utilize a lot of your
personal information for business
purposes which goes Way Beyond the
companies you actually trust and opted
to sign up for the places you enter your
information willingly are the Gateway
but after that goes out everywhere there
are hundreds of data Brokers pedaling
your information to the highest bidder
and it's an impossible process to
contact all of them yourself and fight
objections or get your data removed so
for that there is incog simple process
sign up for the website give them
specific legal permission to work on
your behalf in this particular capacity
and let them know what kind of
information they will be having removed
I have personally done this and as you
can see there are 59 completed requests
with 45 still pending as my data is
systematically removed from Shady
Brokers and corporate servers that never
even wanted to be associated with in the
first place keep in mind incog is
created by the same developers as surf
shark another long-standing partner of
the channel which means we have a
special deal as well the first 100
people to click the link Down Below in
the description and use code Echelon a
checkout will get 20% off their
subscription to incog again link down
below and promo code Echelon for the
first 100 viewers or clickers who use it
to get 20% off their subscription big
thank you to incog for sponsoring the
channel let's dig deeper to be clear
this problem isn't exactly new person
say it's not breaking news of any sort
and the FBI has even warned about this
new emerging attack Vector a couple of
months ago in the end of 2022 but how
many people actually keep up with this
[ __ ] I know some people do and that's
great for them but most people don't
most people have no idea when they
search Google that the ads they see at
the top of the page in the most
authoritative slot might be maliciously
designed to infect their machine and the
more people that understand this kind of
danger the better one of the most
comprehensive analysis writeups for this
particular topic actually comes from a
company called guardio funnily enough
they used to be a video sponsor of mine
which is awesome so it's great to see
them leading the pack with awareness
campaigns and it also benefits me
massively because they've created a
series of infographics for the subject
which I now get to use this is
essentially what it all looks like and
while I did do a search for some
contemporary examples of the malware in
use on Google ads right now none of the
December 2022 versions are currently
operating out in the open at least not
anymore that doesn't mean that there
aren't dozens more campaigns actively
out there as I write this it just means
that Google became aware of that
particular list of known threats in
their AdWords system and they purged
them don't get me wrong that's a good
thing but this is also I guess
reactionary not proactive I do believe
Google is working on this and fixing it
but until we know for certain that it's
been fully curved yeah don't go clicking
on Google ads for digital programs go
straight to the actual Source the basic
gist is this a threat actor Will first
replicate some sort of existing software
product that they have been able to to
infect right they'll take a program that
a lot of people want they'll infect it
with malware Steelers from one of the
families and they'll have something they
can infect a machine for our purpose
today we'll use Turbo Tax as an example
because there are Turbo Tax adverts
actively served at the top of the
results on Google please keep in mind
though this is not a statement against
Turbo Tax in any way it's simply an
example of how the process works Turbo
Tax ads right now on Google as far as I
could tell after examining them are not
infected again just an example once the
replicated page has been made and the
malware has been attached to whatever
program they're going to be using to get
you to install it it will be advertised
through Google to sit at the top of the
search results for all keywords
associated with it side note during the
initial rise of this problem multiple
malware ads would be situated at the
absolute top of all search results for
dozens of popular programs
simultaneously when a user finally
clicks on one of the dummy Pages a
hidden redirect will take them to a
completely different web page the
process is called cloaking which I'll
talk about later on which then attempts
to use a third-party file storage
website or service to prompt users into
downloading whatever it is they were
initially looking for let's say with
Turbo Tax using our current example that
we were looking to get the program and
click on the first sponsored advert
after we search Google the actual site
being advertised by Google would be
clean right the actual domain name that
we think we're clicking on is clean but
when navigating to it you would be
redirected to a separate interface
disguised as if it were real where the
goal is to get you to download something
that is likely too large a file for your
antivirus to actually scan and could be
distributed through a number of options
like Mega Dropbox GitHub Discord or
Google Drive if successful the program
would obviously hijack your system
that's its primary purpose but the scary
part is that sometimes the falsified
sites can be nearly indistinguishable
from the real ones here's some examples
of real versus fake websites that were
part of the first wave of this problem
to clarify here the domain that's
actually advertised through Google's
AdWords program is not something that's
malicious it's actually totally clean to
fool all the different bot checks and
different moderation techniques however
when you click it the redirect takes you
to a different website that then
impersonates a brand and tries to infect
your system right so the first website
that you think you're clicking sometimes
is even just a totally innocent
unconnected thing it's just being
advertised on Google with a very similar
name a very similar domain and the whole
thing is to just trick you into getting
into this redirect funnel and then
downloading the infected files when I
say that this was and likely still is a
widespread problem I absolutely mean it
here's a list of impersonation websites
just for one single brand in this case
MSI afterburner targeting Gamers and
crypto miners to steal all of their
information over 50 entries of
redirected web pages advertised through
Google AdWords placed at the top of the
search results but designed to infect
users rather than allowing them a true
download and that's just one program
with one demographic being targeted what
makes it all even that much more
dangerous is that the falsified websites
will actually install a valid version of
the software for the most part when
clicked if you were to click through
trusting the Google AdWords platform to
be safe and fully installed the infected
files they would actually work for the
purpose that you wanted this attack
Vector is so well-crafted for many
people it would never even trip their
alarm Bells because they would click an
official Google sponsored post download
a file that then runs and opens the
exact program that they wanted on
multiple occasions for a lot of people
but alongside that their entire digital
life has been laid bare which is really
a scary concept these threat actors will
systematically rotate through different
malware variant types ensuring that they
never use the same version for too long
one day it will be raccoon stealer the
next day it could be Redline or vdar for
those that don't know these are names of
malware families that steal information
protect themselves sometimes circumvent
virtual machines even you name it
depending on their level of
sophistication according to threat
analysis posted by HP researcher Patrick
schlapfer who focused it seems on a
campaign targeting users who were
looking to download The Audacity program
Google malvertising as it's called is
not just on the rise it's exploding even
more examples of infected ad campaigns
include szip Microsoft OneNote [ __ ] or
Microsoft teams and for a much more
individual example we can look at a user
named nft God who fell prey to OBS but
again A lot of people are going to
recognize these programs at least a
couple of them as things that they
either have have used in the past or
might get in the future and if you're
going to do that be aware of of this now
keep in mind I don't actually have any
familiarity with who this particular
person is or what they do but they are
nft God presumably a rather prominent
figure in crypto no one really knows
because that space is so botted to hell
it's almost unbelievable but nft God
recounts a tragic scenario where his OBS
download compromised all of his accounts
profiles and communities simultaneously
devastating his life and ruining his
finances crypto is particularly
vulnerable to all this so anyone with
portfolios of digital assets and coins
needs to be hyper aware here's what to
look out for and these tricks may sound
very simple and they are but we all need
to use them all of the time number one
check the domain check for any spelling
mistakes in the domain name of a website
where you are about to download files
always better yet don't click on Google
ads if you're intending to download a
program do so after finding the direct
link to the provider on Google not a
sponsored post even if Google has
largely cleared up the known campaigns
utilizing this method right now there
are more there will be more and they
will be just as dangerous if not worse
in the future number two if you somehow
do find yourself trusting a website and
choosing to download a file from them
remember that the larger the file the
less likely it is your antivirus program
will properly scan it malware is
inflated with thousands and thousands of
useless zeros in the code you can strip
it out but that's a more advanced
process to increase file size as a
method of circumventing default checks
so if you're downloading a 700 Meg File
versus a 45 Meg file often times
antivirus default scans won't even be
conducted on the larger files meaning
that threat actors can use that to their
advantage sneaking code into your system
if you trust it don't let them do that
number three never download anything
from a thirdparty file sharing host
after clicking on a Google ad if I go to
OBS pro.com right now I can download the
installer I want uninfected and it comes
direct from the web page if that page
for some reason tried to make me
download the file from Dropbox for
example yeah never ever do that it might
contain a valid copy of the program you
want in there in addition to the malware
but it also probably contains life
altering Steelers number four use ad
blockers that may seem unrelated but
these attack vectors prey on trust in
this case the trust we have in Google
maybe it's not real trust and maybe most
people actually don't trust Google but
plenty of people will let their guard
down when looking at an official
sponsored listing becoming more likely
to trust it simply because it's at the
top of their search engine and if Google
put it there it must be real various ad
blockers will actually remove most of
these sponsored posts I don't know which
ones and it's kind of a battle between
websites like Google and ad blocking
software where Google wants you to see
the ads the ad blockers want to block
the ads so it's kind of a a back and
forth they're jockeying for position
sometimes one will win the other will
win I mean it's a long track record of
this so yeah have an ad blocker and if
it happens to be one that blocks the
sponsored posts that's great it leaves
you with the actual websites beneath
them which are far less risky right now
and yeah maybe me as a Creator gets less
revenue from people adopting more
aggressive ad blockers but that is
peanuts compared to the destruction of
their digital lives because they clicked
a disguised product advertised through
Google AdWords the reality is cloaking
the process by which a website can be
advertised on Google's platform but then
redirect to malicious payloads or cloned
websites or pages is extremely extremely
common the technique is even used for
domains like Facebook or used on or
against domains like Facebook YouTube
Amazon and more and yes it's a violation
of YouTube's advertising policies or
Google's advertising policies but they
don't catch everything they don't
necessarily catch it quickly and
understanding that the sponsored ads
that you see are far more likely to be
dangerous than anything else on the
search page beneath it is important for
all of us to keep in mind right now no
one knows how many people have actually
been hit by this so far no one knows how
many it will be before the issue gets
fully solved if it ever gets fully
solved though the number of people hit
so far is probably very very high and a
lot of the specific known campaigns have
been disabled which is great but there
will always be more and when a system
like that is under siege with
devastating consequences for users
sometimes it's best to stop engaging
completely for a while and see how
things go me personally I will never be
clicking a sponsored Google search ad
ever again not now not even when they
say the problem is fixed because the
amount of risk you and I are accepting
by doing so is completely unjustifiable
in the end being aware of what we do
online what we click on and where it
takes us is obviously critical right I
mean this is not new information I'm not
saying anything revolutionary in the
slightest but with a platform like
Google awareness becomes even more
important because there are people out
there that trust what they see when it
comes from certain companies making them
even more vulnerable when threat actors
prey on the trust that they have with
that particular brand which can
hopefully be avoided through proper
awareness that's it if you want to
support please check out the links down
below primarily locals in patreon that's
the best way to support the channel if
you feel like it financially merchandise
social media the video sponsor of course
etc etc also some platform Alternatives
where you can watch my videos like
Odyssey and Rumble but yeah I'll cut it
there and stop rambling as always thank
you all for watching and have a nice
night
[Music]