Lowe’s employees phished via Google ads

Malwarebytes observed a malvertising campaign in mid‑August where threat actors purchased Google ads impersonating Lowe’s MyLowesLife portal, redirecting searchers to lookalike domains hosting an AI-built storefront and a phishing kit that captures Sales Number, password, and security-question answers before redirecting victims to the real site; domains, page structure (wamapps), and mitigations (reporting to Google, Malwarebytes protections) are documented.