Threat researchers have uncovered an ongoing series of malicious advertising campaigns (Malvertising) targeting graphic design professionals through ads on Google Search.
From November 13, 2024, the campaign uses two IP addresses, 185.11.61[.]243 and 185.147.124[.]110, to host malicious domains. The first IP identified 109 unique domains related to the Google Search malvertising campaign.
Read more: WarmCookie malware: Infects users through malvertising/malspam campaigns
Silent Push, in collaboration with research partners, has monitored at least ten different campaigns over the past month. These connect users to dangerous downloads, posing a serious threat to corporate systems and individual security.
Revealing the campaigns
The malvertising campaign began via frecadsolutions[.]com, which was hosted on the IP address 185.11.61[.]243 since November 2024. The campaign quickly expanded, adopting variants on domains such as frecadsolutions[.]cc, freecad-solutions[.]net, and rhino3dsolutions[.]io. Furthermore, the use of trusted platforms such as Bitbucket to host malicious files significantly increased the threat.
See also: Malicious Facebook ads distribute info-stealing malware
On December 9, 2024, a new domain, onshape3d[.]org, was detected, which had been hosted since December 1 on the IP 185.147.124[.]110. The switch between two IPs indicates a well-coordinated action by a malicious actor. Despite the clear threat, large companies like Google seem to be neglecting basic investigative practices, such as IP analysis and monitoring.
Silent Push has developed a Future Attack Index (IOFA), offering an advanced method for detecting malicious domains and IPs, thereby strengthening business security. The resilience of these malicious campaigns highlights the urgent need for effective prevention and targeted research action.
Read more: “Konfety”: Malicious ads exploit 250+ Google Play apps
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
