A Google Ad fraud campaign advertises adult sites that may have generated millions of ad impressions on stolen articles. Based on reports, the operators of this newly discovered campaign might have earned more than $200 per month.
Fortunately, Google has shut down the ads for violating their policies towards Google Ads on adult websites. Researchers have yet to attribute the campaign to any threat group, but they know the new scheme originated from Russia.
The Google Ad fraud campaign uses popunders ads to execute its operations.
The Google Ad fraud campaign operators use ‘popunder’ ads to acquire massive traffic from baited users. The advertisements’ cost is cheaper than expected by researchers and opens as pop-ups behind the open browser window. Hence, users will not see the ads until they minimise, move, or close the main browser window.
Online data services, adult content portals, and adult webcams commonly utilise popunders. In this incident, the operators develop legitimate-looking news portals with stolen content from other sites that legitimate popunders ads use.
Unfortunately, instead of showing the web page’s content, the actors overlay an iframe that promotes a “TXXX” adult explicit website. Subsequently, these miscreants embed a Google Ad at the bottom of the webpage to generate ad revenue from the popunders.
The overlaying mechanism is completed by a dynamically created iframe that utilises heavy code obfuscation to bypass automatic analysis by Google’s fraud detection bots. The iframe directs users to a legitimate adult website that is being used to import explicit content.
The researchers explained that once a user accesses the ad, they will be redirected to the popunder. Next, the page loading will stop, and the user will be on another adult website developed by the iframe.
If a user clicks anywhere on the webpage, the page will trigger a simple click on a Google ad.
Researchers have estimated ad impressions to be 76 million per month and the revenue to be about $276,000 per month. However, the provided estimation is only from a recent tally, and some researchers claim that the operators may have gained more profit.
