{"id":15628,"date":"2019-06-25T20:48:01","date_gmt":"2019-06-26T04:48:01","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/06\/25\/news-9377\/"},"modified":"2019-06-25T20:48:01","modified_gmt":"2019-06-26T04:48:01","slug":"news-9377","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2019\/06\/25\/news-9377\/","title":{"rendered":"Recipe for success: tech support scammers zero in via paid search"},"content":{"rendered":"

Credit to Author: Threat Intelligence Team| Date: Tue, 25 Jun 2019 15:00:00 +0000<\/strong><\/p>\n

Tech support scammers are known for engaging in a game of whack-a-mole with defenders. Case in point, last month there were reports that crooks had invaded Microsoft Azure Cloud Services<\/a> to host fake warning pages, also known as browser lockers. In this blog, we take a look at one of the top campaigns that is responsible for driving traffic to those Azure-hosted scareware pages.<\/p>\n

We discovered that the scammers have been buying ads displayed on major Internet portals to target an older demographic. Indeed, they were using paid search results to drive traffic towards decoy blogs that would redirect victims to a browlock page.<\/p>\n

This scheme has actually been going on for months and has intensified recently, all the while keeping the same modus operandi. Although not overly sophisticated, the threat actors behind it have been able to abuse major ad platforms and hosting providers for several months.<\/p>\n

\n
\"\"<\/a><\/figure>\n<\/div>\n

Leveraging paid search results<\/h3>\n

Tech support scams are typically distributed via malvertising campaigns. Cheap adult traffic is usually first on the list for many groups of scammers. Not only is it cost effective, but it also plays into the psychology of users believing they got infected after visiting a dodgy website.<\/p>\n

Other times, we see scammers actively targeting brands by trying to impersonate them. The idea is to reel in victims looking for support with a particular product or service. However, in this particular campaign, the crooks are targeting folks looking up food recipes.<\/p>\n

There are two types of results from a search engine results page (SERP):<\/p>\n