Using Google Search to Find Software Can Be Risky
ID: d30755ff-4e4f-522a-8592-a7cca63b2b10
STIX ID: report--d30755ff-4e4f-522a-8592-a7cca63b2b10
Feed Name: Krebs on Security
Threat Score
A persistent malvertising campaign (MalVirt) is using paid Google search ads to promote spoofed download sites that impersonate popular software and periodically swap in backdoored installers and infostealer payloads. Researchers and user reports show hundreds of similar domains hosted at a single IP, occasional Google Safe Browsing blocks, and historical links to infections by infostealers (IcedID, RedLine, Formbook, AuroraStealer); attackers use automation and hosting rotation to evade detection.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.