What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Criminals used sponsored Google Search results impersonating Google Ads to steal advertisers’ Google credentials, take over advertising accounts, increase spending and potentially reuse trusted accounts to distribute more scams. The documented campaign was reported by Malwarebytes on January 15, 2025; the specific ads and domains in that report are historical, but the attack pattern remains important for anyone who manages Google Ads.
The attack in one sentence
The scam used a fake sponsored result, a Google-branded page hosted on Google Sites, an external phishing page and stolen credentials to compromise advertiser accounts.
The criminals did not need to break directly into Google’s advertising infrastructure. According to Malwarebytes’ investigation, they appear to have used previously compromised advertiser accounts to buy malicious ads. Those accounts gave attackers access to established billing relationships, existing campaigns and advertising budgets.
How the Google Ads phishing operation worked
- An advertiser account was compromised. Some accounts reportedly already contained legitimate campaigns.
- The attacker bought ads for searches such as “Google Ads.” The target was someone trying to sign in or start advertising.
- The sponsored result led to a convincing lure. The principal campaigns used Google Sites, creating a familiar
sites.google.comaddress. - The victim was redirected elsewhere. An external phishing kit presented a fake Google login page.
- Credentials and technical information were collected. Malwarebytes reported collection of usernames, passwords, cookies or identifiers, location data and browser or device characteristics.
- The attacker took over the advertising account. Reported activity included adding administrators or manager accounts, changing campaigns, increasing budgets and sometimes removing or locking out legitimate users.
- The account could be reused. Malwarebytes assessed that compromised accounts might be resold or used to promote further scams and malware.
The important business risk is therefore larger than one fake ad. A stolen advertiser account can become a paid, trusted distribution channel for the next stage of fraud.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
As an Amazon Associate I earn from qualifying purchases.
Why the fake result looked credible
- It appeared as a Sponsored result in Google Search.
- It used Google Ads branding and matched the user’s search intent.
- The initial page was hosted on Google Sites.
- The visible destination could appear superficially consistent with a Google-owned domain.
- The victim was already expecting to sign in to Google Ads.
These signals are not proof of legitimacy. A Google-owned domain means Google controls the hosting service; it does not mean Google endorses every page hosted there. Similarly, sponsored placement identifies paid advertising, not Google’s guarantee that the advertiser or landing page is safe.
What Malwarebytes observed—and what remains unproven
Malwarebytes described several apparent campaign clusters. One contained Portuguese-language comments and was associated with login alerts involving Brazil. Another reportedly used advertiser accounts from Hong Kong and included Chinese-language comments. A separate malware-oriented campaign used fake CAPTCHA pages, cloaking and redirects, with technical clues that Malwarebytes said might suggest an Eastern European connection.
Those clues do not establish the criminals’ identities or nationalities. The safest description is that Malwarebytes observed Portuguese-speaking, Asian-linked or possibly Eastern European clusters, without definitive geographic attribution. Its assessment that thousands of advertisers may have been affected should also be treated as an estimate, not an independently audited victim count.
#1 Best Overall
Who was at risk
The targets included existing advertisers, businesses considering Google Ads, agency staff and employees searching for account access. The risk was particularly serious when the same Google Account also controlled Gmail, YouTube, payment information, business documents or other services.
A hijacked advertising account can expose a business to:
- Unauthorized ad spending.
- New campaigns, keywords, conversion actions or automated rules.
- Unknown users or manager-account links.
- Payment-profile changes.
- Policy violations and account suspension caused by the intruder.
- Loss of administrative access.
- Use of the company’s billing history and reputation to distribute scams.
How to spot a fake Google Ads result
- Do not treat “Sponsored” as a safety certification.
- Inspect the advertiser identity. Use the ad’s information or “About this advertiser” control and compare the advertiser name with the Google entity you expect. An unrelated business name is a warning sign.
- Check the complete destination. Look for misspellings, unexpected subdomains, redirect chains and a page that starts on a Google-owned host but moves elsewhere.
- Use a known route instead. Type the Google Ads address manually or use a trusted bookmark rather than clicking a search ad.
- Use a password manager or passkey. A password manager may refuse to autofill on an unfamiliar domain. Google says passkeys are designed to resist ordinary credential phishing.
- Reject unexpected login prompts. Approve a Google prompt only after confirming that you initiated the login and that the device, browser and location make sense.
Google’s phishing guidance says Google will not send unsolicited messages asking for a password or other sensitive information through an email or link.
Signs your advertising account may be hijacked
Check Admin → Access and security, the change history and billing records for:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- Unknown users, administrators or manager accounts.
- Unexpected MCC links.
- Sudden budget increases or spending outside normal hours.
- New campaigns, ads, keywords, conversion actions or automated rules.
- Unfamiliar languages, countries or products.
- Ads promoting cryptocurrency, software, financial services or technical-support scams.
- Unfamiliar payment-profile links or charges.
- Login alerts from unexpected locations.
- Removed team members or loss of access.
- Policy suspensions that followed changes nobody on your team made.
Before deleting suspicious material, record timestamps, screenshots, ad and landing-page URLs, billing records, account-change history, the 10-digit customer ID, unknown user details and manager-account IDs. Google specifically asks for this type of evidence during compromised-account reporting.
What to do if you clicked or entered your credentials
If you clicked but entered nothing
Close the page, avoid downloading anything and inspect the device and browser. The risk is lower than credential submission, but redirect chains can still expose users to malware. Preserve the URL and time of the visit.
If you entered a password and still have access
- Stop using the suspicious page.
- Move to a clean, trusted device if possible.
- Run a malware and antivirus scan before changing the password. A compromised device could capture the new password.
- Change the Google Account password.
- Enable 2-Step Verification or a passkey.
- Review recent account activity, signed-in devices, recovery methods, sessions, apps and third-party access.
- Remove unfamiliar users and manager accounts only after documenting them.
- Inspect campaigns, billing profiles, domains and advertiser verification.
- Report the incident through Google’s compromised Google Ads account process.
If the password was reused
Change it everywhere it was used. Google’s password guidance recommends using unique passwords for important accounts.
If you were locked out
Start with Google Account recovery, then contact Google Ads support through the compromised-account process. Provide the customer ID and associated email address where possible. If another legitimate administrator or agency owner remains, involve them. Contact the card issuer or bank if unauthorized charges may continue.
Do not simply open a replacement advertising account and resume spending. Preserve the original account’s evidence and resolve the access and billing problem first.
Google’s recovery and reimbursement process
Google’s current guidance generally involves:
- Reporting the compromised account and supplying a timeline.
- Completing identity and account recovery.
- Reauthenticating administrators with MFA or 2-Step Verification.
- Changing or resetting the Google Account password.
- Reviewing the generated account activity change log.
- Approving the cleanup decision.
- Reviewing users, manager accounts, payment profiles, campaigns, domains and advertiser verification.
- Removing unauthorized or policy-violating content.
- Requesting reimbursement if unauthorized charges are confirmed and eligibility requirements are met.
Google may temporarily suspend a compromised account, pause campaigns created or modified by the intruder, remove unauthorized users and manager invitations, unlink unauthorized manager accounts and set spending limits to zero on unauthorized new subaccounts.
Reimbursement is not automatic. Google says it may be available when its investigation confirms both compromise and unauthorized charges, after account recovery and reactivation. 2-Step Verification must be enabled after reactivation. Google says billing investigations can take 10–15 business days; an approved adjustment may appear as “Service Adjustment” on a later invoice, and the final amount may not be confirmed until the billing cycle ends.
If the account was suspended, secure it and remove unauthorized material before treating the matter as an ordinary policy appeal. Malicious ads created by an intruder can cause policy violations even when the legitimate owner did not create them.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
How to harden a Google Ads account
Enable 2-Step Verification
In Google Ads, the current documented path is Admin → Access and security → Security tab → Verification during sign-in → 2-Step Verification. Available methods can include Google prompts, an authenticator app, security keys and SMS. Google notes that changes to recovery information can take up to seven days to propagate across its services.
MFA materially reduces password-only takeovers, but it is not a complete defense. Fraudulent prompt approval, stolen sessions, compromised devices, malicious OAuth access and another compromised administrator can still create risk.
Prefer passkeys or security keys
Passkeys and hardware security keys are stronger against traditional password phishing. They still require secure devices, sound account-recovery procedures and carefully managed administrator access.
Reduce administrator sprawl
- Keep the administrator list small.
- Downgrade inactive administrators.
- Remove former employees and agencies promptly.
- Audit manager-account links regularly.
- Use separate administrative identities where practical.
- Require two-person approval for high-impact changes where available.
Use multi-party approval and monitoring
Multi-party approval requires a second administrator to verify sensitive changes. It can slow urgent edits, but it is valuable where one compromised login could sharply increase spending. Make sure the second approver is available and independent.
Best Value
- This fun, nerdy, geeky, retro Cybersecurity Awareness Month design is perfect to wear this October. Great for cyber security professionals and experts who keep people safe on the internet, safe online, and safe online.
- Wear this for October National Cyber Security Awareness Month this October, raise awareness about cyber security on smartphones, laptops at your school, in the classroom or on your college or university campus. Be safe online and make sure others are too!
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
Monitor daily spend, new campaigns, geographic and language changes, new users, manager links, payment-profile changes, automated rules and login alerts. Google’s Security Agent and related controls may vary by account type or region, so check the controls available in your account.
Train staff on search-ad impersonation
Make this the operational rule: never sign in to Google Ads from a sponsored result claiming to be Google when a known bookmark or manually entered address is available. Staff should also know not to approve unexpected prompts or give passwords to anyone claiming to be Google Ads support.
The broader lesson for advertisers
The incident illustrates a structural problem in online advertising: a compromised account is not merely a private login. It can be a funded media channel with an established identity, billing relationship and ability to reach people at scale.
Google Sites was part of the reported lure infrastructure, but that does not mean Google Sites itself was hacked or that Google operated the phishing page. The observed chain combined compromised advertiser accounts, legitimate hosting abuse, external phishing infrastructure and the victim’s own account security.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →For a small advertiser, the highest-value protections are usually free account controls, unique credentials, MFA, careful access management and regular spend monitoring. Larger advertisers and agencies should consider security keys, separation of duties, centralized identity controls and a documented incident-response process. Consumer antivirus or browser protection can help with malware and known malicious sites, but neither replaces account recovery, least privilege or billing monitoring.
Quick Recap
Bottom line
Reach Google Ads through a known, trusted route—not through a sponsored search result claiming to be Google. If you clicked or entered credentials, treat the event as a potential account compromise: secure the Google Account, preserve evidence, audit every user and manager link, report the incident to Google and request a billing review. The specific 2025 campaign may no longer be active, but the method remains a practical warning for every advertiser.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
