Spyware Turns Up in Google Search Ads

Google last week cracked down on a number of pay-per-click ad accounts being used to send searchers to malware-infected Web sites set up to steal banking accounts and other personal data, the company revealed Friday.

The fraud was notable because the perpetrators not only built bogus Web sites but took out Google AdWords pay-per-click ads to drive traffic to those sites, bidding on popular keywords and in at least one case managing to break into the top pay-per-click ad position.

The scam was first detected by Exploit Prevention Labs, an Atlanta-based developer of security software. The company noted in early April that clicks on ads for the BBB or Cars.com were actually being detoured through a domain called smarttrack.org. There the scammers attempted to install spyware that would alter bank Web pages to capture account information and passwords. Searchers were then passed through to the legitimate sites they were seeking.

EPL said that one of the bogus sites appeared as the top search ad in a search on the phrase “BetterBusinessBureau” on April 23. The company also reported that a search on the phrase “how to start a business” produced a smarttrack.org site masquerading as an ad from legit small-business resource site AllBusiness.com.

The exploit appeared to target Windows ZP users who had not installed the most recent security patch from Microsoft, EPL said.

In a post on its Inside AdWords blog last Thursday, Google said it had cancelled the AdWords accounts responsible for the malware sites.

“This is an issue we’ve taken very seriously and will continue to monitor,” the blog post said. “We are also evaluating our systems to ensure that the appropriate measures are in place to block future attempts. Google is committed to ensuring the safety and security of our users and our advertisers. We actively work to detect and remove sites that serve malware to our users both in our ad network and in our search results.”