“Zero-Code Cloaking”: Attackers Weaponize Google Search and Hacked .ac.th Domain to Bypass Ad Moderation
Attackers chain Google search results, a hacked Thai .ac.th domain, and redirects to push illegal casino ads past moderation, at industrialized scale across gov/edu sites.
ADEX researchers documented a 'zero-code cloaking' technique in which an ad's destination URL loads a Google search results page whose poisoned top result is a casino page planted on the compromised Thai university domain km.chpc.ac.th, which then redirects users to illegal gambling sites. Because every visitor receives identical content, ad-verification tools that inspect only the declared landing URL detect nothing malicious. ADEX cites data showing roughly 30 million gambling URLs across about 1,000 Thai public-sector sites, hundreds of blocked gov/edu domains in Indonesia, and underground markets selling access to more than 15,000 compromised .gov and .edu domains. Google's site reputation abuse policy offers little coverage because hacked site owners are victims rather than willing participants.