Google ad impersonates Whales Market and promotes malware

A legitimate Google Search for cryptocurrency trading platform “Whales Market” is promoting malware that drains users’ wallets and steals all their assets.

See also: AZORult malware spreads via fake Google websites

Whales Market is a decentralized over-the-counter trading platform that allows users to trade assets on blockchains. It recently said it discovered a phishing for its trading platform in Google search results.

A quick search for Whales Market on Google brought up a sponsored ad at the top of the search results, displaying what appear to be legitimate URLs for the site. The ad displays www.whales.market, which is not a valid hostname ,but is the correct domain for whales.market. Hovering over the ad also shows that the link leads to the correct URL https://whales.market.

However, clicking the link redirects users through a series of sites, to the phishing site https://app.whaless[.]market/. As you can see, the domain of this site has an extra s in the word whales.

This phishing website copies the legitimate Whales Market website, including its trading platform, but contains malware that, if you connect your wallet, will empty it of all assets.

See also: “TicTacToe Droppers” are used to distribute malware

Before connecting your wallet to any Web3, checking the domain displayed in a browser's address bar is crucial to determining whether it is a legitimate site. If you find yourself on a site that looks even slightly different, do not connect your wallet to it.

Threat actors have been abusing Google Ads for years to distribute malware or redirect users to phishing sites and tech support scams.

Other brands impersonated by legitimate Google ads include Keepass, Home Depot, Amazon, eBay, and even Google YouTube - owned .

When these malicious ads are created, such as the fake Whales Market page promoting Wallet Drainer Malware, Google and Microsoft search bots will visit the ad URL to verify the website. However, when the malicious website detects a known Google or Microsoft user agent or IP address ,it will redirect the request to the legitimate website being promoted.

However, when a regular visitor clicks on these ads, they will instead be redirected to malicious websites that push malware, phishing attacks, or scams.

See also: TheMoon malware infected 6,000 ASUS routers

Google is not the only one affected by malicious ads, with similar techniques being used on Microsoft and X's advertising platforms.

Wallet Drainer Malware, like the one promoted by the fake Whales Market page, is a type of malware designed to steal digital assets from its victims. The malware infiltrates the user’s system through various techniques, such as spear phishing, drive-by downloads, or through exploited vulnerabilities in the operating system. Once installed, Wallet Drainer Malware begins monitoring the user’s activity, focusing on cryptocurrency transactions. The malware is able to identify and record digital wallet addresses, access keys, and other sensitive information. After collecting this information, Wallet Drainer Malware uses it to make unauthorized transactions, emptying the digital wallets of its victims.

In some cases, the malware can also spoof wallet addresses entered by the user, leading the cryptocurrencies to accounts controlled by the attackers. It is important to note that Wallet Drainer Malware is often difficult to detect and remove, as it is designed to remain hidden on the user’s system. The best defense is prevention, which includes keeping software updated, using strong passwords, and being careful with digital assets.

Source: bleepingcomputer