Google AdWords used to distribute malware

Posted 23 January 2009 15:46pm by Patricio Robles with 6 comments

• Tweet

• Tweet

Given how lucrative online crime can be, it probably isn't surprising that internet scammers continue to develop clever new ways of finding new victims.

One of the latest: Google AdWords.

According to InternetNews, scammers are purchasing legitimate-looking AdWords campaigns and using them to redirect searchers who click on those ads to malicious websites. Some contain viruses and trojans that have been designed to avoid detection by anti-virus programs. Some of these malicious websites even employ 'scareware' to trick victims into believing that they're providing anti-virus software.

One might think that this type of abuse of AdWords would be easy for Google to thwart but that appears not to be the case.

According to Ryan Sherstobitoff of anti-virus vendor Panda Software, "If you do a Google search using the term free antivirus 2009, all the sponsored links point back towards scareware. Now, instead of stealing your banking information, these spammers infect your PC and make you pay for the fake anti-malware immediately."

Making matters worse, traffic management applications are used to help scammers avoid detection. When someone clicks on a scammer's AdWords ad, for instance, sometimes they'll be redirected to a legitimate website. Thus, even if Google receives a complaint, it might not immediately be able to confirm the complaint.

While the sophistication and ingenuity of online scammers isn't surprising, the threat from the abuse of paid search ads is disturbing. If abuse becomes too widespread, these ads could lose their effectiveness, especially amongst those who have a bad experience and in turn become more hesitant to click on a paid ad. Fighting this scourge should be a priority for Google (and any other search providers who provide paid ads).

Additionally, I think it highlights that vigilance SEMs need to have in monitoring their own campaigns. With scammers already copying whole websites and setting up phantom stores to steal from people, I can't help but think that a similar technique might eventually be employed with these AdWords scams.

It's a dangerous online world out there.