Google AdSense has been targeted by a malicious advertising campaign that attempts to hide itself by redirecting to sites spoofing popular magazines, according the security firm Sucuri.
Sites with AdSense banners are inadvertently sending their users to fake sites offering "health secrets" to skin care, ageing, weight loss and brain boosters, with brands such as Forbes and Good Housekeeping among those being spoofed alongside fake but plausible websites.
Denis Sinegubko, senior malware researcher at Sucuri, said: "At least two AdWords campaigns have been hijacked by scammers who modified legitimate ads to automatically redirect visitors to scam sites once they get displayed (no clicks required)."
"The malicious redirect worked even in the Ad Review Center of the Google AdSense dashboard on google.com site where webmasters may view ads that Google displays on their sites."
He added that the problem started in the second half of December, peaking on January 9 and reducing in scale on the weekend as Google took action against the problem.
Confirming the campaign in a forum thread, Google said: "This ad is a known bad ad and our malvertising team is actively working on blocking it across the network as we speak. In addition to blocking it via your account, please do file feedback directly with AdWords."
Users on a Google AdSense support forum were able to find out more about the scam, connecting it with two AdWords campaigns and allowing webmasters to block adverts from the relevant accounts.
However Sinegubko said that as of January 13 Google had still not blocked those accounts, lending weight to the argument that they were legitimate, but had been hijacked by hackers.
"Such redirects are not the only bad thing we can expect from third-party script [in adverts]," he added. "They can easily contain browser exploits. And even perfectly legitimate scripts may be modified if their site gets hacked.
"If Google doesn’t control scripts in their ads, AdSense may eventually turn into the largest malvertising platform despite of the still prevailing opinion that that Google Ads are probably the most safe ad network out there."
