An unprecedented advertising scam that leveraged Google ads and “popunders” on pornographic websites is estimated to have generated millions of ad impressions from stolen articles, earning criminals an estimated $275,000 per month.
See also: Google Ads: They will offer access to advertisers' history
The campaign was discovered by Malwarebytes, which reported it to Google and removed it for violating policies prohibiting Google Ads on adult websites.
Although the origin of this campaign remains a mystery, Malwarebytes' analysis indicates that the perpetrator is likely from Russia.
See also: Google ads direct users to fake crypto wallets
'Popunders' and Google Ads
The threat actor used “popunder” ads to create numerous advertising campaigns on high-traffic adult websites.
These ads are incredibly effective and open as “pop-ups” behind the active browser window, remaining invisible until you close or move the main browser window.
“Popunders” are commonly used by adult-oriented websites, such as online dating services and live webcams.
In this case, the scammer creates legitimate-looking news portals with scraped content from other websites, which are used as "popunder" ads.
Instead of displaying the page content, they have implemented an intrusive iframe that advertises an adult website 'TXXX'.
To generate advertising revenue from these popunders, hackers also embed a Google ad at the bottom of the page, violating Google's advertising policies, as shown below.
The overlaying is achieved by a dynamically constructed iframe that uses “heavy code obfuscation” to avoid automatic analysis by Google’s fraud detection bots . The iframe points to txxx.tube, a legitimate adult content website , which it uses to insert adult content.
Articles in the background
The articles loaded in the background (under the adult content iframe) were stolen from legitimate sites, mainly educational programs, articles, and guides.
These pages contained an average of five Google ads, sometimes even video ads that generate more significant revenue.
See also: eBike phishing websites promote scams through Google Ads
The scammer updates the background with a brand new article and set of ads every nine seconds, resulting in countless deceptive ad impressions if someone views the page for just a few minutes.
Malicious overlay ads are a type of malware infection that can be found on websites and mobile. These types of ads, also known as “malicious advertising,” are designed to trick users into clicking on them, thereby exposing their device to malicious content. This not only poses a security risk to the user, but can also have serious consequences for the company whose website or app was infected.
Information source: bleepingcomputer.com
