Search: “google-ads”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews

Bitdefender reports deceptive Google Play Early Access apps use deepfake celebrity ads and fake rewards to lure users into ad-fraud schemes.

Bitdefender research describes widespread abuse of Google Play's Early Access program, where developers publish deceptive apps that avoid public ratings and reviews. The apps are promoted through TikTok and Facebook ads promising cash rewards, PayPal payouts, crypto earnings, or gift cards, often using deepfakes of celebrities, but users receive only aggressive advertising. Examples include 'Chicken Road' and 'Ice Fishing' casino-style games plus trademark abuse such as apps named 'Grand Theft Auto V (Early Access)' that are later renamed. No malware is delivered, but some listings show thousands of installs.

SecurityWeek·updated Sep 11, 12:14 UTC · 5d ago·first Sep 10, 13:39 UTC · 6d agoPhishing & fraud in the wild 6 sources

42

Scareware ads keep running on Google's transparency tool, even after they're reported

NYU and Radboud researchers built AdLens, which found 238 scareware and 3,346 false-claim ads in Google's ad archive; reported ads often stayed live.

The AdLens tool, built by NYU and Radboud University researchers, mined Google's Ads Transparency Center and screened 188,000 software ad creatives using similarity search plus a panel of open-source language models, finding 238 scareware ads, 3,346 false-claim ads, and 258 anonymity-avoiding ads with over 100 million impressions in Europe. Reporting ads through Google's standard flow produced inconsistent removals: some ads acknowledged as violations stayed live, and after one takedown tied to the TamperedChef malware domain, 41 other ads pointing to the same domain kept running. The pipeline runs entirely on open-weight models at low cost (a $96 DigitalOcean VM plus $1.57/hour L40S inference) and is designed to extend to Meta and Amazon ad libraries.

Help Net Security·Sep 2, 00:00 UTC · 14d agoResearch

33

Can We Stop The Ads? Taxonomy and Characterization of Smartphone Splash Ads and Existing Countermeasures

Study of 108 ad-defense implementations finds only one tool blocked splash-ad navigation across ten popular apps, and it required Accessibility permission.

The paper taxonomizes smartphone splash ads — full-screen ads at app launch that trick users into trigger mechanisms such as moving the phone — and analyzes 108 documented advertising defenses for deployment barriers. Many defenses require device rooting, jailbreaking, runtime code injection, or application modification; others need extra permissions, rule maintenance, compilation, or payment. In evaluating 13 configurations of 11 tools across 10 popular apps, only one prevented ad-triggered navigation across all ten apps, requiring Accessibility permission and leaving ads visible roughly one second before dismissal. Documented harms include delayed emergency response, driver distraction, and degraded accessibility for vision-impaired users.

arXiv cs.CR·Sep 15, 15:24 UTC · 22h agoResearch

32

Evolve your marketing with new AI tools

Google announced new AI and agentic features across Google Ads and Google Analytics to simplify marketing workflows.

Google published a product announcement introducing AI and agentic experiences across Google Ads and Google Analytics. The features are aimed at simplifying marketing workflows. No technical details, benchmarks, or security-relevant content were included.

Google · AI·Aug 10, 14:30 UTC · Aug 10, 2026AI industry

12

Google Search Makes It Harder to See Where a Link Really Goes Before You Click

Google now routes some Search results through opaque google.com/goto redirects, weakening hover-to-verify anti-phishing checks.

Google has begun serving some organic search results as opaque google.com/goto?url= redirects whose destinations can only be resolved server-side by Google, likely to raise scraping costs for rank trackers and archival services. The change removes the pre-click hover preview of the true destination URL, undermining a long-standing anti-phishing habit for spotting lookalike, typosquatted, or search-optimized phishing domains. Security teams are advised to rely on layered defenses such as domain reputation, DNS and web filtering, browser isolation, and user training rather than hover text.

GBHackers·Sep 15, 13:42 UTC · 1d agoIndustry

30

Malicious Ads Infostealer League

Malicious advertisements delivered an infostealer in a widespread malvertising campaign.

The report describes malicious advertisements that distribute an information-stealer to users who click or interact with the ads. Infostealers typically harvest saved browser passwords, session cookies, and cryptocurrency wallet data from infected machines. The specific malware family, ad networks abused, and victim counts are not stated in the headline.

Infosecurity Magazine·Aug 16, 00:00 UTC · Aug 16, 2026Malware in the wild

45

Google’s New Search Redirects Make It Harder to Check Where Links Lead Before Clicking

Malwarebytes reports Google's new encoded google.com/goto?url= redirects break hover-preview link checking, weakening a common phishing defense.

Google now routes some search results through opaque google.com/goto?url= redirects using custom encoding, so browser link previews no longer reveal the true destination, only the claimed label above the result. Malwarebytes found the final destination is visible only in the redirect response's Location header, complicating hover-based safety checks as well as scraping, archiving, and audit tools. The change arrives amid malvertising, search-result poisoning, and fake installer campaigns like the recent Node.js infostealer lure. Google says it deploys measures against evolving abuse but did not explain the change.

Cyber Security News·Sep 15, 12:21 UTC · 1d agoResearch

30

Google’s new search redirects make links harder to check before you click

Google routes some search result links through encoded google.com/goto?url= redirects, breaking hover-to-verify link checks and raising scraping costs.

Google has started routing some search result links through opaque google.com/goto?url=... redirects using a custom Google-specific encoding, with the destination visible only via the redirect response's Location header. Google confirmed the rollout as an anti-abuse measure, most likely to make bulk extraction of destination URLs from search results more difficult and costly. Malwarebytes warns the change undermines the standard hover-before-clicking safety advice, while legitimate rank-tracking, SEO auditing, archival, and accessibility tools now face the same rate limits and costs as abusive scrapers.

Malwarebytes Labs·Sep 14, 14:17 UTC · 2d agoIndustry

20

Testing ads in ChatGPT

OpenAI begins testing ads in ChatGPT, promising clear labeling, answer independence, privacy protections, and user control.

OpenAI is starting to test advertisements in ChatGPT to support free access to the chatbot. The company states ads will carry clear labeling, remain independent of answers, include strong privacy protections, and offer user control options.

OpenAI News·Aug 11, 10:00 UTC · Aug 11, 2026AI industry

15

“This is the AI men actually use”: Meta ads pushed apps nudifying real teens

TTP found Meta ran ads for AI nudify apps using real photos of minors, including a CSAM ad, drawing scrutiny from US and Australian regulators.

The Tech Transparency Project reported that Meta served ads for AI nudify apps using photos of real teens, which collectively reached over 29,000 people in the EU and 6,800 in the UK, with about 80% of ads shown in the US. A Facebook page posing as representing the Church of Jesus Christ of Latter-day Saints ran a CSAM ad that Meta only disabled after TTP flagged it. Michigan and Florida attorneys general are investigating, Senator Mark Warner has demanded action, and Australia's eSafety regulator requested information from Meta at a senior level. Meta said flagged ads averaged fewer than 200 impressions with total spend under $5,000.

Ars Technica · AI·Sep 8, 18:43 UTC · 7d agoAI safety & security

45

This Tool Unmasks the Shadowy World of Ads that Track Your Location

404 Media covers DecryptAds, a new tool offering a massive queryable dataset for investigating location-tracking advertising.

404 Media reports on DecryptAds, a new tool paired with a large queryable dataset designed to make investigating the advertising industry's location-tracking practices much easier. The article is paywalled, so further technical details about the dataset are limited.

404 Media·Aug 12, 12:49 UTC · Aug 12, 2026Tools

20

ChatGPT Ads expands across Europe

OpenAI is expanding ChatGPT Ads to 31 European markets, letting advertisers reach users as they explore, compare, and decide.

OpenAI announced that ChatGPT Ads is expanding to 31 European markets. The move extends OpenAI's advertising monetization, allowing advertisers to reach users during exploration, comparison of options, and purchase decisions. The announcement has no direct security relevance and carries no risk beyond competitive AI industry impact.

OpenAI News·Aug 18, 22:00 UTC · 28d agoAI industry

32

5 new ways to level up your learning with Search

Google promotes five Search study tools for students preparing for classes and standardized tests.

Google published a back-to-school post highlighting five ways to use Search tools when studying for classes and standardized tests. The post is promotional product guidance rather than a launch, research result, or security announcement.

Google · AI·Aug 19, 19:00 UTC · 27d agoAI industry

12

A milestone in expanding access to AI

OpenAI announced ChatGPT Ads reached a $1 billion annualized revenue run rate and expanded availability globally to fund free and affordable AI access.

OpenAI stated that ChatGPT Ads, its advertising product, has reached $1 billion in annualized revenue run rate. The company framed this as a milestone that expands global availability of the ads product and supports broader access to AI through free and lower-cost options. No technical, model, or security details were included in the announcement.

OpenAI News·Aug 31, 04:00 UTC · 16d agoAI industry

50

Reimagining advertising with AInew

OpenAI launches ChatGPT advertising features including Sponsored Agents, AI ad creation in Ads Manager, and integrations with HubSpot and Shopify.

OpenAI is testing Sponsored Agents in the United States, letting users converse with clearly labeled business-sponsored agents after clicking ads in ChatGPT. Advertisers can create, update, and analyze campaigns via natural-language prompts in ChatGPT with an Ads Manager plugin, plus AI-suggested copy and imagery in Ads Manager. HubSpot becomes the first CRM partner and Shopify the first ecommerce partner, with the Shopify app expanding internationally on September 23.

OpenAI News·13:00 UTC · 1h agoAI industry

60

AI for Societal Impact

Google publishes a collection page showcasing partnerships applying AI to health, disaster prediction, learning, and economic opportunity.

Google's 'AI for Societal Impact' page curates examples of experts and local leaders applying AI to disease detection and prevention, natural disaster prediction, education, and economic opportunity. It is a marketing-oriented collection page with no new technical details.

Google · AI·Sep 15, 16:00 UTC · 22h agoAI industry

10

3 new ways to plan and book travel in Search

Google Search's AI Mode adds travel features: hotel booking, airfare tracking, and airline miles and rewards visibility.

Google introduced three new travel capabilities in Search's AI Mode, including hotel booking, airfare tracking, and viewing airline miles and rewards. The features extend AI Mode from informational queries into transactional travel planning. The announcement positions Google Search to compete more directly with travel-focused booking services.

Google · AI·Aug 27, 16:00 UTC · 19d agoAI industry

18

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Talos tracks a crypto-theft campaign abusing the Google Visualization API for C2, using browser-based ClickFix lures to inject web-skimmer JavaScript.

Criminal actors convinced targets to paste JavaScript into Chrome's address bar or install it in the Tampermonkey extension, injecting a web skimmer into sessions on two cryptocurrency trading websites; Tampermonkey also provides persistence. Since March 2026 the campaign retrieved obfuscated scripts via the Google Visualization API from public Google Sheets documents, hooking the fetch API and replacing cryptocurrency deposit addresses in responses and the clipboard. Lures pose as leaked reports of a nonexistent API flaw at cryptocurrency swap services and spread via Telegram, DarkForums, and paste sites since early October 2025. Talos warns the legitimate-service-abuse techniques could enable wider supply-chain attacks on e-commerce and customer-facing systems.

Cisco Talos·Sep 8, 10:00 UTC · 8d agoPhishing & fraud in the wild

48

Free ChatGPT users get ads picked from whatever they just asked about

OpenAI will serve ads to ChatGPT Free and Go users based on conversation topics, location and device, with personalized targeting behind opt-in.

OpenAI will begin showing ads in ChatGPT for Free and Go plan users, selected from the current conversation topic plus general location and device type. Personalized ad targeting using in-product activity and conversation context will only start after an explicit opt-in, with a setting to manage the choice afterward. Plus, Pro, Enterprise, Business and Education subscribers remain ad-free, and OpenAI states that chats, chat history, memories and personal details are not shared with advertisers. A privacy policy update will document the ad labels, controls and performance reporting.

Help Net Security·Aug 31, 00:00 UTC · 16d agoAI industry

55

San Francisco Orders Meta to Stop ‘Allowing’ AI Child Abuse Ads

San Francisco's city attorney sent Meta a cease-and-desist over 350+ ads containing AI-generated child sexual abuse content, demanding remediation within 28 days.

San Francisco City Attorney David Chiu issued a cease-and-desist ordering Meta to stop 'allowing' paid ads with AI-generated child sexual abuse content and demanding answers within 28 days about moderation failures. Tech Transparency Project researchers found more than 350 ads that turned images of minors, some of real people including a European royal family member, into videos depicting sexual acts, directing users to AI nudify apps; the ads reached over 29,000 accounts across the EU, US, Australia and India. Meta says all ads have been removed, most had fewer than 200 impressions and total ad spend was under $5,000, and argues the ads ran outside the city attorney's jurisdiction.

WIRED · Security·updated Sep 11, 18:59 UTC · 4d ago·first Sep 9, 21:15 UTC · 6d agoAI safety & security 3 sources

45

Google researchers uncover criminal zero-day exploit likely built with AI

Google links a likely LLM-built criminal zero-day for an open-source admin tool to planned mass exploitation and maps AI-assisted threats.

Google Threat Intelligence Group linked a zero-day exploit for a popular open-source web-based administration tool, enabling 2FA bypass with valid credentials via a semantic logic error, to a criminal group, citing educational docstrings, a hallucinated CVSS score, and textbook Python as signs of LLM authorship; the vendor was notified before a planned mass exploitation campaign. The report also details Russia-nexus malware families CANFAIL and LONGSTREAM using AI-generated decoy code, the PROMPTSPY Android backdoor driving the UI through the Gemini API, APT27 using Gemini to build relay tooling, and the TeamPCP (UNC6780) supply chain compromise of LiteLLM and Trivy repositories that planted the SANDCLOCK credential stealer.

Help Net Security·Aug 24, 04:21 UTC · 23d agoThreat actor

78

Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency

Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.

Cisco Talos uncovered a cryptocurrency theft campaign that abuses Google Sheets and the Google Visualization API as a covert C2 channel, delivering obfuscated JavaScript into victims' Chrome browser sessions via ClickFix-style social engineering. Victims are lured with a fake "API Logic Flaw" report promising 25-38% bonuses on SimpleSwap and SwapZone swaps; the injected payload acts as a browser-based web skimmer that replaces deposit addresses, overrides the fetch API, and hijacks the clipboard. Later variants use the legitimate Tampermonkey extension with a user script for persistence without OS-level compromise. Talos identified 49 Bitcoin wallets, with 24 reused addresses receiving about 0.159 BTC (~$10,000) before mixing through more than 3,000 addresses.

GBHackers·Sep 9, 06:22 UTC · 7d agoPhishing & fraud in the wild

52

Fake bank websites play dead to evade security scanners

Fortra uncovered Chameleon SEO Poisoning: cloaked typosquat bank sites rank on Google and Bing to steal credentials while evading scanners, with cases up 40% in Q2 2026.

Fortra's threat intelligence unit FIRE spent three months tracking Chameleon SEO Poisoning, a phishing method that ranks recently registered typosquat domains on second-level domains like .ph.com and .gr.com above legitimate bank sites on Google and Bing. The technique uses presentation control (cloaking by referrer): direct visits get a dead, offline-looking page, while search-referred clicks receive a convincing fake bank login page, letting poisoned results persist for days or weeks. Fortra recorded a 40% jump in cases during the second quarter of 2026 and recommends referrer-spoofed URL testing, faster SLD takedowns, and bookmarking bank logins.

Help Net Security·Aug 24, 00:00 UTC · 23d agoPhishing & fraud in the wild

58

Hackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential-Stealing Malware

Cisco Talos details ClickFix campaigns abusing fake Google CAPTCHA prompts, WebDAV and BNB Smart Chain to deploy the Amatera infostealer.

Cisco Talos identified a multi-stage campaign, first observed in April 2026 when a Ukrainian government organization executed a disguised DLL named verification.google from a WebDAV path. The chain combines ClearFake JavaScript injected via malicious Cloudflare Workers, EtherHiding payloads stored in BNB Smart Chain contracts, ClickFix social engineering, and WebDAV-hosted DLL loaders to deliver the Amatera (ACR Stealer) infostealer. The Amatera configuration contained over 400 collection entries targeting browsers, messengers, crypto wallets, password managers, FTP and VPN tools, hunting for .kdbx, .p12, .pfx and .pem files. The pf.ch branch deploys ZigCryptoStealer, an EDR-terminating vulnerable driver and Go-based reverse TCP proxies, while the verification.google branch installs NetSupport Manager, supporting moderate-confidence attribution of the UAT-10820 activity to a Russian actor.

GBHackers·Sep 9, 13:27 UTC · 7d agoMalware in the wild

55

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.

GBHackers·Sep 11, 12:24 UTC · 5d agoMalware in the wild2

66

Google's new AI model predicts the future from sales data, weather, and discount schedules

Google Research released TimesFM-3, a 330M-parameter multivariate time series forecasting model that tops Gift-Eval, FEV-Bench, and Time benchmarks and is on Hugging Face.

Google Research released TimesFM-3, a 330-million-parameter Transformer-based time series forecasting model trained on more than one trillion real and synthetic data points. It works zero-shot and adds multivariate support, ingesting related series, historical-only covariates, and known future events such as discount schedules and weather forecasts, while filling all future time steps in a single one-shot pass. Google reports first place among pretrained forecasting models on Gift-Eval, FEV-Bench, and Time, ahead of Amazon's Chronos-2, the Toto-2.0 family, and its own TimesFM-2.5. Weights are available on GitHub and Hugging Face, with BigQuery integration planned in the coming weeks.

The Decoder·Sep 12, 09:26 UTC · 4d agoModel release2

48