Phishing Attacks Are Now Leveraging Google Ads to Hijack Employee Payments

Researchers warn of an active payroll-redirect phishing campaign that uses malicious Google Ads to promote spoofed HR/Workday pages; attackers harvest employee credentials and change direct-deposit information to steal paychecks, leveraging website builders and newly-registered domains across registrars and dedicated IP ranges to rapidly spin up infrastructure targeting numerous high-profile organizations.