Ankura CTIX FLASH Update - January 17, 2025

Malware Activity

A series of malicious campaigns have been identified, targeting individuals and businesses.

A series of malicious campaigns have been identified, targeting individuals and businesses through various means. A malvertising campaign has been active since mid-November 2024, targeting Google Ads users with fake ads that redirect to phishing sites hosted on Google Sites, stealing credentials and two-factor authentication codes to take over accounts and push more fake ads. Additionally, cybercriminals are using Google search ads to promote phishing sites that steal advertisers' credentials, with at least three (3) groups, including Portuguese speakers, behind the attacks. Meanwhile, a malware campaign has compromised over 5,000 WordPress sites, creating admin accounts, installing malicious plugins, and stealing sensitive data. Furthermore, threat actors are distributing information stealer malware disguised as proof-of-concept (PoC) exploit code for a