“Zero-Code Cloaking”: Attackers Weaponize Google Search and Hacked .ac.th Domain to Bypass Ad Moderation
Attackers chain Google search results, a hacked Thai .ac.th domain, and redirects to push illegal casino ads past moderation, at industrialized scale across gov/edu sites.
ADEX researchers documented a 'zero-code cloaking' technique in which an ad's destination URL loads a Google search results page whose poisoned top result is a casino page planted on the compromised Thai university domain km.chpc.ac.th, which then redirects users to illegal gambling sites. Because every visitor receives identical content, ad-verification tools that inspect only the declared landing URL detect nothing malicious. ADEX cites data showing roughly 30 million gambling URLs across about 1,000 Thai public-sector sites, hundreds of blocked gov/edu domains in Indonesia, and underground markets selling access to more than 15,000 compromised .gov and .edu domains. Google's site reputation abuse policy offers little coverage because hacked site owners are victims rather than willing participants.
- No cloaking code: Google SERP plus hacked edu domain plus redirect
- Compromised km.chpc.ac.th ranked first for targeted queries
- About 30M gambling URLs found across ~1,000 Thai public-sector sites
- Underground market sells access to 15,000+ gov/edu domains
- Ad verification only inspects the declared landing page
- Products
- Google Ads
- Organizations
- ADEXMinistry of Digital Economy and Society
From the original article
4 min read at gbhackers.com
Security researchers at ADEX have documented a cloaking technique that requires no cloaking code at all. Instead of running user-agent detection on attacker-controlled servers, the operators chained together three fully legitimate components a Google search results page, a hacked educational website, and a standard redirect in an evasion strategy designed to bypass Google Ads screening […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.