Malicious Google Ads Pushing Fake IP Scanner Software with Hidden Backdoor

Zscaler ThreatLabz identified a Google Ads-driven malvertising campaign (≈45 typosquatted domains mimicking IP scanner tools) distributing a new Windows backdoor called MadMxShell. Delivery uses a ZIP containing Advanced-ip-scanner.exe and IVIEWERS.dll; the DLL performs process hollowing, unpacks OneDrive.exe and Secur32.dll, abuses DLL sideloading to run shellcode, establishes persistence via scheduled tasks, disables Microsoft Defender, and uses DNS MX queries (subdomain-encoded FQDNs) to communicate with C2 (litterbolo.com).