Google Ads Exploited to Host Phishing Traps via Google.com Domain

Security researchers at GoPlus have issued an urgent alert regarding a sophisticated phishing campaign targeting cryptocurrency users through Google Search ads. The warning highlights a deceptive tactic where attackers utilize the trusted google.com top-level domain to mask malicious links, specifically targeting individuals searching for popular decentralized finance (DeFi) platforms. This exploit aims to bypass traditional user skepticism by leveraging the perceived security of official hosting services.

Exploitation of Google Sites and Ad Services

According to reports from the community, users searching for terms such as "PancakeSwap" are being presented with high-ranking sponsored results that appear legitimate. Investigation by GoPlus reveals that cybercriminals are deploying phishing interfaces on Google Sites, a structured wiki- and web-page-creation tool offered by Google. By hosting the scam on this platform, the malicious URL displays a google.com suffix in the browser address bar, which significantly increases the likelihood of a successful attack.

The attackers leverage the following methods:

• Search Engine Advertising: Paying for top-tier placement to ensure high visibility among investors.
• Domain Masquerading: Using official Google subdomains to lower the psychological barriers of the target.
• Redirect Mechanisms: Once a user interacts with the page, they are often prompted to connect their Web3 wallets, leading to potential asset drainage.

Risk Mitigation for DeFi Users

The primary danger of this specific campaign is the displacement of trust. Traditionally, users are taught to verify the domain name before entering sensitive information; however, because these sites are technically hosted on a Google-owned infrastructure, standard red flags may be absent. Phishing remains one of the most prevalent threats in the crypto ecosystem, often resulting in the permanent loss of digital assets from networks like BNB Chain or Ethereum.

Users may let down their guard when visiting malicious websites due to seeing the google.com top-level domain in the address bar, thus falling into phishing traps.

To maintain security, GoPlus advises the community to exercise extreme caution when interacting with sponsored content.

To safeguard assets, investors are encouraged to bookmark official URLs of frequently used decentralized exchanges (DEXs) and avoid clicking on "Sponsored" results in search engines. Verifying the authenticity of a site through multiple independent sources, such as official social media channels or reputable aggregators like CoinMarketCap, remains a critical practice. As phishing tactics evolve to use legitimate cloud infrastructures, the responsibility for transaction verification and link scrutiny falls increasingly on the end-user to prevent unauthorized access to their private keys and seed phrases.