New 3-Step Malvertising Chain Exploits Facebook Ads to Promote Tech Support Scam Kit
A recent malvertising campaign has been identified, specifically targeting users in the United States. This attack utilizes Facebook's advertising platform to direct users to a tech support scam (TSS) kit.
A recent malvertising campaign has been identified, specifically targeting users in the United States. This attack utilizes Facebook's advertising platform to direct users to a tech support scam (TSS) kit.
The campaign is characterized by rapid infrastructure changes and a three-step redirection process designed to circumvent standard security measures.
The attack initiates with a paid advertisement on Facebook. These ads appear legitimate, blending into a user's social media feed. Upon clicking the advertisement, the following sequence occurs:
Facebook Advertisement: The initial stage involves a sponsored post on Facebook. Threat actors use paid placements to ensure their malicious links reach targeted demographics. Decoy Site: After clicking the ad, users are redirected to a decoy site. In this case, the decoy is themed as an Italian restaurant, serving as an intermediary to evade detection by crawlers. Final Payload: The decoy site redirects the user to a tech support scam landing page hosted on Microsoft Azure infrastructure, utilizing the *.web.core.windows.net domain. This adds legitimacy and complicates domain blocking efforts.
This campaign is active and targets US users. Analysis reveals a domain rotation strategy, with over 100 unique domains used in seven days. Activity aligns with business hours, indicating manual management rather than automation.
A recent malvertising campaign has been identified, specifically targeting users in the United States.
Azure's static web hosting is used to create professional-looking scam pages that display fake system warnings, urging users to call fraudulent support numbers.
Security teams have blocked this campaign using URL pattern matching and HTML signature analysis. The use of Azure subdomains and specific scripts on landing pages provides a detection signature.
Users should exercise caution with sponsored content on social media. Organizations are advised to update web filtering rules to scrutinize redirects from social media ads, especially those leading to cloud hosting subdomains.
Indicator Value Type Context/Description
hxxtps[:]//www.facebook[.]com/ads/library/?id=1202995272012769 URL Malicious Facebook Advertiser Profile (Ad Library source).
simplydeliciouspairing[.]com Domain Decoy / Intermediate Redirect Page.
jacquesrocha[.]z13.web.core[.]windows[.]net Hostname Tech Support Scam (TSS) Landing Page (Azure Storage).
Based on reporting by GBHackers.