Hackers exploit ad tools to track victims, boosting scam efforts


Hackers are sending malicious PDF attachments containing a link that’s registered through an advertising network, security researchers from HP Inc, said. — Photo by Towfiqu barbhuiya on Unsplash

Cybercriminals are using advertising tools to make their scams as “clickable” as possible.

In a new kind of email phishing tactic, hackers are sending malicious PDF attachments containing a link that’s registered through an advertising network, security researchers from HP Inc said in findings released Thursday. When email recipients click the link, which hackers use to collect analytics on the number of clicks that their messages attract, they’re directed to a kind of malware called DarkGate.

Advertising tools allow hackers to more effectively evade detection and, crucially, measure the extent to which their scam operations are successful in much the same way that legitimate websites analyse their Internet traffic. Because the link is registered under a legitimate advertising network, it has a more credible URL, which is less likely to draw scepticism by potential victims, according to researchers.

“Cybercriminals are applying the same tools a business might use to manage a marketing campaign to optimise their malware campaigns, increasing the likelihood the user will take the bait,” said Ian Pratt, global head of security for personal systems at HP.

Hackers have also utilised other legitimate corporate tools to advance their operations like PowerShell, a task automation program from Microsoft Corp, and WinSCP, a file manager.

DarkGate malware is capable of collecting keystrokes and accessing sensitive files, according to cybersecurity research. It’s sold on various Russian-speaking cybercriminal forums.

Ad services also help hackers subvert many automated cybersecurity products by including a CAPTCHA test to determine is someone is a human or a bot. CAPTCHAs defeat many cyber tools because the automated nature of their scanning, a standard practice, fails the identity test.

The DarkGate campaign has experimented with different types of PDFs to trick victims, including one depicting a fake OneDrive error and the other in the style of an Adobe Reader interface, according to Alex Holland, a senior malware analyst on HP’s threat research team.

“That’s probably an indicator that they’re actually using these analytical tools to assess which lure is more effective than the other,” Holland added. – Bloomberg

Follow us on our official WhatsApp channel for breaking news alerts and key updates!

Next In Tech News

Reddit shares plummet as investors fret over miss in daily active unique visitors
Spanish travel technology group HBX slumps on market debut
Exclusive-India's SEBI seeks greater access to social media records, say source and memo
German cartel office warns Apple app tracking tool could violate rules
Teens and the risks of generative AI
Alibaba wins prized role powering AI on Apple’s iPhone in China
Embracer misses quarterly profit forecast on higher costs, weak box office
Opinion: Ethical dilemmas of AI need illumination
Scammers using AI to dupe the lonely looking for love
Musk will pull OpenAI bid if ChatGPT maker remains a non-profit, lawyers say

Others Also Read