Google ads push fake Google Authenticator site installing malware

A malvertising campaign abused Google Search ads to impersonate Google Authenticator and redirect users to fake landing pages (e.g., chromeweb-authenticators.com and similar domains) that deliver a signed executable named "Authenticator.exe" hosted on GitHub. Executing the file launches DeerStealer, an information stealer that harvests browser credentials, cookies, and other data; the campaign uses URL cloaking and mass account creation to evade detection and even presented verified advertiser identities. The report notes code signing on multiple samples, which can help the malware bypass Windows/AV checks, and recommends avoiding promoted search results, using ad blockers, verifying official domains, and scanning downloads before execution.