Fraudulent ads hosted on official Google domains may appear legitimate, making detection of the deception difficult, warns Víctor Ruiz, founder of SILIKN and cybersecurity specialist.
Government institutions in Mexico using Google Ads for public procedures and services are at risk of being victims of a sophisticated malicious campaign utilizing fake ads on the platform, according to a report by SILIKN.
The identified threat reveals that cybercriminals from various parts of the world have been mimicking Google Ads login pages, redirecting users to fraudulent websites hosted on Google Sites to steal credentials.
"The tactic is simple but very effective. Its goal is to deceive users to steal access credentials and then use them to execute fraudulent campaigns, spread malware, and finance other illicit activities," states Víctor Ruiz.
Scammers show ads with URLs that seem legitimate to trick victims. If they gain access to government accounts, they could spread fake ads, divert funds, and distribute malware targeting citizens seeking to carry out online procedures.
In light of this threat, SILIKN recommends that government agencies implement urgent security measures such as enabling multi-factor authentication on Google Ads accounts, continuously monitoring advertising activity, training staff to identify phishing attempts, conducting periodic security audits, and collaborating with cybersecurity experts.
Among the most vulnerable entities are the SAT, IMSS, Infonavit, the Secretariat of Education of Veracruz, the Undersecretariat of Higher Secondary Education, and various municipalities across several states, managing financial, health, and educational information of millions of citizens, which could lead to massive fraud, identity theft, and significant economic losses.
Google Ads, a platform that generated approximately $175 billion in advertising revenue in 2023, is affected by such incidents impacting both advertisers and end users.
