The malvertisers lurked in Google search results and for a moment, they had the top two ad positions when a search for YouTube was entered.
“Cybercrooks made it look very real, with the supposed destination URL actually being the real YouTube website, and providing a preview of a YouTube channel when you hovered over a link with your mouse, making it possible to fool even very security-savvy users,” explained Jerome Segura, a researcher at Malwarebytes Lab.
Essentially, the scammers latched onto the keyword “YouTube” to get their ads to appear at the top, before organic search results.
When victims clicked on these specific links, they were directed to a website that displayed a “helpline” phone number to call, as part of a tech support scam. “It was, quite possibly, the first documented BSOD tech support scam, which combined Google AdWords, the largest online advertising service in technology,” Segura said.
Victims who ended up calling the fake support number could have been scammed out of $200 to $600 for unnecessary support packages. The criminals often commit identity theft and also try to empty victims’ bank accounts.
“Many times these fraudulent advertisers will abuse legitimate trademarks to trick people and provide services on behalf of these companies,” Segura said. “Beyond copyright infringement laws, there is also the almost ever-present social engineering that follows, to trick people into spending hundreds of dollars for no good reason.”
Malwarebytes reported the campaign to Google and the fake ads were promptly removed, but it’s a good reminder to be vigilant, even when a link seems legitimate!
