Ad servers considered harmful. New twist

[Wudang]

Here’s how it works: Cybercriminals pay for a sponsored ad on Google pretending to be a major brand. Often, this ad leads people to a fake website. However, in the cases we recently found, the visitor is taken to the legitimate site with a small difference.


Visitors are taken to the help/support section of the brand’s website, but instead of the genuine phone number, the hijackers display their scammy number instead.

Easily something that could slip by the less tech aware, more vulnerable or just people in a rush.
In my hosts file I have google and other ad servers pointing at 0.0.0.0

Scammers hijack websites of Bank of America, Netflix, Microsoft, and more to insert fake phone number

Scammers are abusing sponsored search results, displaying their scammy phone number on legitimate brand websites.

www.malwarebytes.com

 

[Jack by the hedge]

I'm confused by the headline claim that this scam is "on legitimate branded websites". Isn't it only on the sponsored link displayed on a Google (or whoever) search, and not on the page the legit URL goes to? The fake info is mixed in with legit stuff in the sponsored ad.

When it said "the browser address bar" I assumed that meant the displayed URL of the page you are actually on, but surely it can't mean that. If my browser says I'm on an https page that's "trusted-company.com/support" then that really is what I'm looking at and not some adulterated version with fake stuff pasted onto it. Surely.

 

[Wudang]

If you look at the Netflix example in the article, you'll see an example. The sponsored ad includes a query that is then loaded into the, in this case, Netflix web page. If someone is naive, in a rush, distracted etc, it's easy to see how someone could just focus in on the "Call 1-866...."

eta: pardon lack of clarity. Up late packing then awake at silly am to drive my daughter to the airport across the Pennines.

 

[Jack by the hedge]

Ah, right, thanks. Having read on it becomes clearer. So they can direct you to a legit help page but with their chosen text pre-entered into an available text pane.

 

[Wudang]

millennial fulcrum (@falcennial@mastodon.social)

"disable your ad blocker" is the "take off the condom" of corporate media

mastodon.social

 

[Dabop]

Ad hijacking is nothing new- they were warning of that when I was still running a (almost new) XP system lol