How Scammers Use Google Ads to Target Brands & Customers

Did you know, that scammers can weaponize Google Ads to target a brand and its customers? Anyone can buy and run ads on Google Search for any set of keywords. All they need to do is pick and keyword and pay for it to be on top of the results page. Scammers do the same. They buy and run ads that show up on top of Google results when a customer/ user searches for a specific brand-related keyword.

When clicked, these ads redirect users to phishing or fraudulent web pages. Some of these websites redirect to phishing pages of the target brand and others might redirect users to elaborate scams like asking them to call a fake customer support number.

These phishing pages trick users into giving up confidential information such as their login credentials, account details, and Personal Identifiable Information (PII). The fake customer support webpages ask users to call a fake customer support number and carry out their scam.

Scammers use this collected information to hijack accounts, drain crypto wallets and use the Personal Identifiable Information to build more data points on their future victims.

Examples of scam campaigns on Google Ads

Recently, attackers ran a scam campaign targeting Trezor (crypto wallet) users. Whenever a user searched for Trezor-related keywords on Google, they saw ads impersonating the Trezor website pop up on top. These ads lead to fake look-alike websites that try to phish users for their wallet seed phrase. If the victim enters the seed phrase, their crypto wallet is drained empty by the scammers.

In another uncovered ongoing scam, a Twitter user was able to identify a fake Google Ads campaign that was able to steal over 100 ETH (Over 200 thousand USD)