January 12, 2017 By Mark Samuels 2 min read

Cybercriminals are using compromised websites and ad fraud to hijack revenue from business owners. Bleeping Computer recently reported that researchers had detected two campaigns in the past few weeks that seem unrelated. Both errant operations exploited Google’s specialist service AdSense, which gives website holders the opportunity to run advertisements alongside their content.

Analyzing Two Ad Fraud Assaults

Cybersecurity firm Sucuri discovered the first campaign, which focused on fake ad panels. Specialists at the company were asked to analyze giant ads that ran over content on a series of compromised websites.

The attacks relied on the insertion of malicious JavaScript code that placed the giant Google ads on top of the website’s own content. The assaults ran on both mobile and desktop sites and across a variety of platforms, including WordPress, Joomla and HTML-based sites.

Clickjacking Costs Businesses Billions

Rather than running on compromised pages, the second campaign involved pushing users to nefarious websites, according to security firm Malwarebytes. The company referred to the attack as a clickjacking campaign in which errant individuals were abusing Google ads for personal financial gain, potentially costing authentic businesses billions of dollars.

Any visitors to a high-traffic adult site were automatically redirected to a separate page that appeared to stream other adult videos. This second website was, in fact, fake. Visitors trying to play the video were directed to a hidden ad. Unwitting clicks on this paid ad generated cash for the criminals behind the scam, SC Magazine reported.

Fraud Fuels the Ad Market

Although probably unrelated, both campaigns caused problems for users and business owners related to potential security concerns and financial loss. Malwarebytes suggested that there is a direct correlation between growth in the ad market and fraud.

For its part, Sucuri suggested that this type of ad fraud has become increasingly common. If there is money to be made, criminals will look for potential loopholes.

Business owners and website managers should beware of the risk posed by ad fraud and clickjacking. These stakeholders should also regularly check the Google ads on their sites and consider using tools to help monitor malicious activity. Integrity monitoring technology can help them stay on top of website modifications and unwanted alterations.

More from

Exploring the 2024 Worldwide Managed Detection and Response Vendor Assessment

3 min read - Research firm IDC recently released its 2024 Worldwide Managed Detection and Response Vendor Assessment, which both highlights leaders in the market and examines the evolution of MDR as a critical component of IT security infrastructure. Here are the key takeaways. The current state of MDR According to the assessment, “the MDR market has evolved extensively over the past couple of years. This should be seen as a positive movement as MDR providers have had to evolve to meet the growing…

Regulatory harmonization in OT-critical infrastructure faces hurdles

3 min read - In an effort to enhance cyber resilience across critical infrastructure, the Office of the National Cyber Director (ONCD) has recently released a summary of feedback from its 2023 Cybersecurity Regulatory Harmonization Request for Information (RFI). The responses reveal major concerns from critical infrastructure industries related to operational technology (OT), such as energy, transport and manufacturing. Their worries include the current fragmented regulatory landscape and difficulty adapting to new cyber regulations. The frustration appears to be unanimous. Meanwhile, the magnitude of…

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today