Google Ads is currently serving malware

3 points by stinky613 ↗ HN
Steps to recreate:

Go to https://www.google.com

Search for 'walmart'

The top result is an ad that appears to be for Walmart.com

WARNING - MALICIOUS URL:

https://www.google.com/aclk?sa=L&ai=DChcSEwjOg4vXwK7TAhUFgGkKHS9vC9EYABAAGgJpcQ&sig=AOD64_3_4octTbmC5G2Nb3xDVZ2NSTPRXA&q=&ved=0ahUKEwjUsIPXwK7TAhVB7IMKHcbiCZ4Q0QwIIw&adurl=

The link redirects to techsuppoortcenter.us [sic]

I tested these steps 1) on a Windows 7 PC (both Chrome and IE) on a corporate network 2) on a Mac with Chrome over a VPN 3) on an Android phone with Chrome over cellular internet

Note that "data-preconnect-urls" includes both walmart.com and the malicious (non-walmart) website:

    <a href="https://www.google.com/aclk?sa=L&amp;ai=DChcSEwiovvW-y67TAhUBEWkKHT5LC9sYABAAGgJpcQ&amp;sig=AOD64_0rRlaI552aSP76PKakt3W_BAHSlQ&amp;q=&amp;ved=0ahUKEwiU-u2-y67TAhUs4oMKHTcXBNMQ0QwIIw&amp;adurl=" id="vs0p1c0" onmousedown="return google.arwt(this)" data-preconnect-urls="http://www.walmart.com/,http://techsuppoortcenter.us/" jsl="$t t-zxXzjt1d4B0;$x 0;" class="r-i_4sBuVBkxq8">walmart.com - walmart - Frash Products‎</a>

1 comment

[ 3.1 ms ] story [ 16.7 ms ] thread