Malicious Ads Bypass Google Ads Screening via New Campaign Platform Exploit
A platform named 1Campaign has been developed to facilitate the execution of malicious Google Ads campaigns while avoiding detection. This platform is designed to support malvertising activities by filtering out researchers and automated scanners,…
A platform named 1Campaign has been developed to facilitate the execution of malicious Google Ads campaigns while avoiding detection. This platform is designed to support malvertising activities by filtering out researchers and automated scanners, thereby maintaining the online presence of phishing and cryptocurrency-draining sites for extended durations.
1Campaign, operated by an entity using the alias DuppyMeister, has been active for over three years. It provides customer support via Telegram and offers attackers an integrated dashboard featuring real-time visitor filtering, fraud scoring, geographic and device targeting, and a bot guard script generator. This makes it a comprehensive tool for large-scale ad abuse.
The core functionality of 1Campaign is as a cloaking engine, allowing different web content to be displayed to visitors based on their identity. Google review systems, brand-protection bots, and security scanners see benign "white" webpages, whereas real users encounter malicious or phishing content. This technique enables fraudulent Google Ads campaigns to pass initial screenings and remain active longer before being taken down.
1Campaign enhances traditional cloaking by providing advanced analytics and visitor tracking, as well as dynamic blocking of known cloud IPs, VPN traffic, and cybersecurity vendor infrastructure. According to research by Varonis, operators can use this tool to create advertisements using any text or keywords, effectively circumventing Google Ads policy enforcement. Operators can refine access rules to ensure only real human victims reach the phishing sites, thereby optimizing the effectiveness of their campaigns.
A platform named 1Campaign has been developed to facilitate the execution of malicious Google Ads campaigns while avoiding detection.
1Campaign enables precise targeting based on geographic location and device type. Campaign analytics have shown traffic originating from the U.S., Netherlands, Canada, China, Germany, and France. This geo-filtering capability allows attackers to prioritize regions relevant to their phishing content and avoid areas with high research activity, thus extending campaign longevity.
The platform's features also include a module that assists in launching both benign and malicious Google Ads campaigns. This capability enables brand impersonation and large-scale ad fraud, allowing attackers to mimic trusted organizations while directing users to fraudulent sites for credential theft or cryptocurrency draining.
The existence of platforms like 1Campaign highlights vulnerabilities in traditional phishing detection systems. Automated URL scanners and brand monitoring tools are increasingly being detected and bypassed before they can analyze any malicious content. The high block rate achieved by 1Campaign illustrates the platform's effectiveness in isolating genuine users from defender visibility.
To address these challenges, cybersecurity analysts need advanced detection systems capable of simulating real human behavior. Varonis has emphasized the importance of tools like their Interceptor, which can track user interactions through forms, CAPTCHAs, and redirects, uncovering the malicious infrastructure that traditional scanners may miss. This behavioral analysis approach is critical for exposing cloaked pages and understanding the threats powered by 1Campaign.
Based on reporting by GBHackers.