Researchers have discovered two connected advertising fraud campaigns that compromise legitimate web sites and abuse Google AdSense, using tactics that are almost polar opposites of each other. While one campaign obtrusively places advertisements over web content, compelling users to click on them, the other attempts to generate clicks by furtively hiding ads underneath a free gift offer.
According to a Tuesday blog post, researchers at Sucuri detected both malware-driven campaigns, which appear to be either perpetrated by or linked to Indonesian hackers who have defaced some of the websites that also displayed the fraudulent ads.
Visitors who click on the nuisance ads in hopes they will disappear are actually playing right into the hands of the fraudsters, who profit with every click generated as they essentially steal from legitimate advertisers.
The malware is designed to collect data from a site visitor's device, establish that visitor's location, and then connect with a malicious URL to determine if the visitor's profile matches criteria established by the cyber-criminals. If the visitor is an ideal target, the malware generates JSON code containing a Google AdSense client ID and an ad slot ID to build an ad on the spot.
The AdSense client ID was exactly the same on every infected site that Sucuri observed, and even works on sites that already had their own AdSense blocks. This constitutes a flagrant abuse of Google's AdSense policy, which allows a publisher to place its ad code on the same pages that another publisher's code resides on, but only with the permission of the site's owner, the Sucuri blog post explains.
"We take all forms of invalid activity and traffic very seriously, which is why we invest heavily in technology and resources to keep bad ads, bad sites and bad traffic out of our platforms," said a Google spokesperson, in a statement provided to SC Media. "We have extensive policies in place to protect users from harmful content across our networks and enforce those policies vigorously."
Sucuri reported that some of the sites compromised by the script were later re-infected with a clickjacking malware that creates unwanted Google AdSense ad blocks and hides them underneath a different ad. The ad Sucuri researchers could see was offering a free gift opportunity, but visitors who click on this lure are actually clicking on the ad concealed beneath it.
The hidden AdSense blocks, which are actually hard-coded directly into the <head> section of affected web pages, are invisible because the fraudsters have programmed them with an opacity of zero, meaning they are fully transparent.
Denis Sinegubko, Sucuri blog post author and senior malware researcher, said that the ad injections may also be the work of Indonesian hackers “who might be experimenting with monetisation of the sites that they hack. Maybe not the same group, but someone from that region with a similar background.”
In April 2016, Google published a blog post that acknowledged the growing threat of clickjacking and reported the company's efforts to defend its ad services. "Our clickjacking defenses operate at considerable scale, analysing display ad placements across mobile and desktop platforms, evaluating a variety of characteristics," the blog post states. "When our system detects a clickjacking attempt, we zero in on the traffic attributed to that placement, and remove it from upcoming payment reports to ensure that advertisers are not charged for those clicks."