30
30
55
55
30
30
30
30
30
30
30
42
30
30
30
Scareware ads keep running on Google's transparency tool, even after they're reported
NYU and Radboud researchers built AdLens, which found 238 scareware and 3,346 false-claim ads in Google's ad archive; reported ads often stayed live.
The AdLens tool, built by NYU and Radboud University researchers, mined Google's Ads Transparency Center and screened 188,000 software ad creatives using similarity search plus a panel of open-source language models, finding 238 scareware ads, 3,346 false-claim ads, and 258 anonymity-avoiding ads with over 100 million impressions in Europe. Reporting ads through Google's standard flow produced inconsistent removals: some ads acknowledged as violations stayed live, and after one takedown tied to the TamperedChef malware domain, 41 other ads pointing to the same domain kept running. The pipeline runs entirely on open-weight models at low cost (a $96 DigitalOcean VM plus $1.57/hour L40S inference) and is designed to extend to Meta and Amazon ad libraries.
33
Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems
Unit 42 built an ML-based detector for malicious traffic distribution systems, finding malicious TDS chains average longer redirections and more URLs than legitimate ones.
Traffic distribution systems redirect victims through chains of intermediate domains to hide final destinations, serving phishing, malvertising, and online gambling operations. Unit 42's topological analysis of redirection graphs found malicious TDS traffic uses longer chains (about 25% exceed four hops vs 10% benign), more URLs (median 126 vs 80), and fewer isolated subgraphs with higher connectivity. These features power an ML detector integrated into Advanced DNS Security and Advanced URL Filtering to identify and block malicious TDS infrastructure in customer traffic.
40
55
30
30
30
30
30
30
55
30
30
30
30
30
55
30
30
30
30
55
30
30
30
30