Watch out for phony cryptocurrency sites.
Cybercriminals have stolen millions of dollars using Google ads that sent internet users searching blockchain-related terms to phishing sites.
The scammers purchased Google search ads that spoofed Blockchain.info, a major provider of Bitcoin digital wallets. The ads appeared at the top of search pages for users who Googled "blockchain" or "bitcoin wallets," according to Cisco's Talos security group and Ukrainian police, which warned about the scheme on Wednesday.
However, none of the ads sent users to the real Blockchain.info domain. Instead, they forwarded victims to look-alike pages that were actually under the control of the scammers. Any personal information entered into the dummy sites, such as passwords to digital wallets, was stolen.
Cisco's Talos group discovered the scheme in February 2017, when it noticed the phony sites were attracting around 200,000 client queries per hour. The security researchers then tracked down the scammers' own Bitcoin wallets, which had amassed around $10 million worth of bitcoin from September to December.
"In one specific run, they made $2M within 3.5 week period," Cisco Talos said.
So far, Google hasn't commented on the ad abuse. But the company has been flagging the web domains involved in the scam as "deceptive sites." Ukrainian police also said the search giant introduced new rules to its ad platform to crack down on the fraud.
The scam from last year was actually pretty easy to spot. It relied on web addresses with spelling errors, such as "blokchein.info," "block-clain.info" and "bockchain.info." However, non-English speakers may have had trouble noticing the difference. Computers based in Nigeria, Ghana, and Estonia were among those found visiting the malicious web pages. (A full list of the spoofed domains can be found here.)
It isn't clear who was behind the scam, but it relied on an internet hosting provider in Ukraine. Cisco Talos is also warning that the bad actors could strike again. They've been observed creating domain names that look like blockchain.com, but actually use Cyrillic alphabet characters for English ones.
"These attacks can be nearly impossible to spot with the human eye," Talos said.
To avoid falling for the scams, it's best to be careful around internet links found in online ads, emails, or social media posts. Hackers like to push legitimate-looking content in the hopes you'll fall for their trap. PCMag has a guide with more tips here.