Google Ads is a technology platform tracked across 20 threat clusters and 28 intelligence report mentions on ThreatCluster. First observed November 13, 2025; most recent activity July 16, 2026.
A new Windows loader named OXLOADER is delivering the CASTLESTEALER infostealer through malicious Google Ads. This previously undocumented malware employs advanced obfuscation techniques and abuses the Windows .reloc…
The InstallFix campaign targets users by creating fake installation pages for Anthropic's Claude AI, tricking them into executing malware. This sophisticated social engineering tactic exploits the growing reliance on AI…
A large-scale malvertising campaign has been identified, leveraging tax-themed Google Ads to deliver a BYOVD-based EDR killer. The campaign, active since January 2026, exploits popular search queries related to tax…
A phishing campaign exploiting Google Ads is targeting users of GoDaddy's ManageWP platform, which is used for managing multiple WordPress sites. The attackers employ an adversary-in-the-middle (AiTM) technique,…
A new malware campaign, dubbed Operation FlutterBridge, is targeting macOS users by distributing a backdoor known as FlutterShell through malicious ads. Hackers are using Google Ads to promote fake desktop applications…
Threat actors are exploiting ChatGPT's content-sharing feature to deliver malware through a campaign dubbed 'LLMShare.' This attack involves creating fake outage pages on the legitimate chatgpt.com domain, tricking…
In H1 2026, telemetry from Gen's Threat Report revealed that AI agents are executing malicious actions within developer workstations and cloud environments. These actions include attempts at reverse shells,…
A malvertising campaign has emerged, targeting macOS users globally with a new variant of the AMOS infostealer known as 'malext.' Attackers are utilizing Google ads to direct victims to fake help articles on…
A malvertising campaign identified in September 2025 has targeted Windows users by promoting fake PDF editing applications through Google Ads. The malware, known as TamperedChef, has compromised over 100 organizations…
The 1Campaign platform allows hackers to run malicious Google Ads that evade detection by security measures. Victims encounter phishing content, while security researchers and automated systems see only blank pages.…