- Varonis discovered 1Campaign, a cloaking tool for malicious Google ads
- Shows phishing/scam content to victims, blank pages to reviewers and scanners.
- Delivers analytics, visitor profiling, fraud scoring, and brand impersonation at scale.
For three years, someone has been selling a tool that allows criminals to run malicious Google ads that are only shown to highly relevant targets.
Security researchers Varonis named the service 1Campaign and, in a detailed report, described 1Campaign as a “cloak,” through which malicious actors can display different content to different visitors.
While real victims see real phishing or scam content, security researchers, ad platform reviewers, and automated scanners see a basic blank page. “This allows fraudulent Google Ads campaigns to pass initial review and remain active longer before being reported,” Varonis explained.
Launch of advertising campaigns
But 1Campaign is more than just a cloak. The tool offers real-time analytics, visitor profiling, fraud scoring, as well as an option to block traffic from known security providers, data centers, and VPNs.
“Each visitor is assigned a fraud score from 0 to 100. Visitors from Microsoft Corporation, Google, Tencent Cloud Computing, OVH Hosting, and other cloud providers are automatically flagged with high fraud scores and blocked,” the researchers explained.
Security scanners identify themselves through IP ranges, ISPs, and behavioral patterns, meaning attackers can configure exactly who sees their malicious content and who sees a blank page.
Developed by a hacker alias ‘DuppyMeister’, 1Campaign distributed traffic to the United States, Canada, the Netherlands, China, Germany, France, Japan, Hungary and Albania. The platform also comes with a Google Ads launcher tool through which bad actors can launch both malicious and benign campaigns.
DuppyMeister says this allows 1Campaign to bypass policy limitations and launch ads “like anyone else.” Basically, it means that criminals can counterfeit any brand.
“This directly enables ad fraud at scale, allowing attackers to impersonate legitimate brands and services in their Google Ads campaigns while evading automated policy enforcement,” the researchers concluded.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp also.
