Malvertising Campaign Builds a Phish for Lowe's Employees

Malwarebytes researchers observed a phishing campaign that leveraged sponsored Google search ads to surface typosquatting sites mimicking Lowe's MyLowesLife employee portal. Victims who clicked the ads were presented with realistic login pages requesting account numbers, passwords, and answers to security questions; submitted data was forwarded to an attacker-controlled phishing kit. The report lists the malicious domains (myloveslife.net, mylifelowes.org, mylifelowes.net, myliveloves.net) and notes attackers used generic AI-generated homepages to hinder detection and takedown efforts.