Unmasking 1Campaign: The Professionalized ‘Cloaking’ Service Powering Global Malvertising Scams

Varonis Threat Labs uncovered '1Campaign', a full-service cloaking platform that enables threat actors to run large-scale malicious Google Ads by presenting benign pages to automated reviewers and redirecting real users to phishing sites, crypto drainers, and malware droppers. The toolkit includes real-time visitor profiling, fraud scoring (0–100), geographic targeting, and automated filters that block traffic from cloud providers and security vendors; observed campaigns showed extreme filtering (only 0.6% of visitors approved) to evade detection and keep malicious ads running until victims report them.