Threat actors abuse Google ads to spread malware across Australian businesses

Cybercriminals have refined a long-standing distribution method into a high-conversion channel, paying for placements in Google search results that look indistinguishable from genuine vendor links. Sponsored slots at the top of a results page are being weaponised to push infostealers, RATs, and loader-stage payloads onto unsuspecting users. For Australian organisations, the combination of a heavily English-language search landscape and a workforce that relies on quick Google queries makes this tactic unusually effective.

The technique, often called malvertising, is not new, but the scale and polish of recent campaigns have alarmed incident responders from Sydney to Perth. A search for a popular piece of enterprise software, a PDF utility, or even a tax-related tool can return a sponsored listing that points to a look-alike domain. Once clicked, the visitor is funnelled through a series of redirects before being served a trojanised installer or a drive-by payload.

Australia's digital economy and high rate of cloud adoption make local endpoints a worthwhile target. Government estimates put the cost of cybercrime to the Australian economy at more than AUD $33 billion annually, and incidents continue to climb. With the Australian Cyber Security Centre (ACSC) publishing regular advisories on search-engine abuse, the issue has moved from a curiosity to a recurring item on the agenda of every blue-team standup.

Security teams that previously focused on phishing emails now have to monitor paid search placements as well. The shift demands a different kind of vigilance, one that blends brand-protection monitoring with endpoint detection and response. The sections below break down how the abuse works, why Australians are particularly exposed, and what defenders can do about it.

The mechanics of malvertising in search results

At the heart of every campaign is a sponsored search advertisement purchased through Google Ads. Threat actors register a domain that closely resembles a legitimate brand, often substituting characters or appending words like "support" or "download" to appear relevant. The ad copy is lifted from real marketing material, with feature lists and version numbers, making it difficult for casual users to spot the difference.

When a user clicks, the traffic is filtered through traffic-distribution systems that screen for bots, virtual machines, and security researchers before deciding what payload to deliver. A clean IP might receive a credential-harvesting landing page, while a corporate IP could be redirected to a benign site to avoid suspicion. This conditional serving is one reason the campaigns persist for weeks before being reported.

The payloads themselves are often stage-one loaders written in Go, Rust, or .NET, which makes static detection harder for traditional antivirus engines. Once executed, the loader contacts a command-and-control server, often over HTTPS, and pulls down secondary implants. These can include information stealers targeting browser credentials, crypto wallets, and session cookies, as well as remote-access trojans.

Australian researchers have observed a pattern where the sponsored slot for a particular query rotates between multiple hijacker-controlled advertiser accounts. When one ad is taken down, another takes its place within hours, frustrating brand-protection teams.

Why Australian users are in the crosshairs

Several local realities make Australia an attractive market for malvertising operators. English-language search behaviour is dominant, so payloads written for global audiences do not need to be localised. Australian users tend to trust the first few results of a Google search more than users in some other regions, because of the country's relatively late adoption of alternative search engines.

The Australian workforce also shows a strong preference for SaaS tools and downloaded utilities. Common queries such as "PDF merge tool" or "free antivirus" produce a high volume of ad clicks. Attackers buy those keywords in bulk, knowing the click-through rate is high and the chance of an enterprise machine being among the visitors is non-trivial.

Regulatory context adds another layer. Under the Notifiable Data Breaches scheme, organisations must notify the Office of the Australian Information Commissioner (OAIC) when a serious breach occurs. The same obligations do not exist in every jurisdiction, so a successful campaign against an Australian firm is more likely to generate public reporting and amplify the impact.

The sheer geographic spread of the country pushes many users to rely on quick online searches rather than phone calls. A tradie in regional Queensland, a small-business owner in Hobart, or a junior analyst in Parramatta is just as likely to type a vendor's name into Google as anyone in a CBD office, and the same malvertising trap catches them.

Notable campaigns and their Australian footprint

Over the past year, several campaigns have been traced back to clusters that targeted Australian IP ranges. One cluster spoofed a well-known remote-access utility, registering .com.au-style look-alikes and buying Google Ads for queries with "download" and "free trial". Australian visitors were served a payload signed with a code-signing certificate stolen from a small software house in Melbourne.

Another wave impersonated accounting and payroll software, an attractive lure during EOFY season when small business owners search for BAS lodgement helpers. The attackers knew that ATO-related queries spike between June and August and timed their ad spend accordingly. Anyone who clicked was prompted to install a "compatibility update" that was a loader for the RedLine family.

A third incident involved ads pretending to be official support pages for the major Australian banks. The landing pages were near-perfect copies, complete with the right colour palette and disclaimer text in the footer. Researchers later determined that the kit had been configured to harvest the first two digits of the Australian Business Number (ABN) before redirecting the visitor to the real bank site, a quiet test for high-value targets.

For a look at how earlier malvertising waves played out across the broader security landscape, the archives at secnews24.com/2018/08 remain a useful reference point. The patterns of brand impersonation, redirect chains, and conditional payloads have not changed as much as defenders hope.

The role of legitimate-looking landing pages

The landing page is where most of the deception happens. A well-built page will have a working navigation menu, a privacy policy link, and a customer-support chat widget that loads a real transcript loop. Some campaigns go so far as to display a "scanning your system" animation that ends with a fake threat report, prompting the user to download a "fix" which is the actual malware.

These pages are often hosted on compromised legitimate websites, particularly small-business WordPress installations that have not been patched in months. Australian web hosting providers have reported takedown requests tied to old Magento and Joomla sites repurposed as redirect hops. A real domain with a long history helps the page pass reputation checks and slip past some URL filters.

Code on the landing page performs a series of checks. It probes for headless browser traits, looks at the screen resolution, and reads the user-agent string before deciding which payload to serve. If the visitor appears to be a security researcher, the page displays a clean "product not available" message, a quiet form of evasion that buys the campaign another few days.

The visual polish is not accidental. Kits sold on cybercrime forums include premium templates, CDN-backed hosting, and customer-service integrations. The result is a distribution channel that looks and feels like a legitimate SaaS business.

Detecting and containing the threat

Defenders in Australia have practical options for spotting malvertising before it costs them. Continuous brand monitoring that watches for newly registered domains containing your product names is a strong starting point. Services that track Google Ads in real time, including those that screenshot sponsored slots for tracked keywords, can shorten the time between a campaign going live and an alert.

Endpoint detection is the second line of defence. Behavioural rules that flag unsigned binaries launched from user-downloads folders, or that block known loader families by hash and YARA pattern, will catch a meaningful share of payloads. Recent AusCERT advisories show the same small set of malware families keeps reappearing, which means a well-tuned detection rule pays for itself many times over.

Network-side controls also matter. Blocking categories such as "newly registered domains" at the DNS resolver can stop a redirect chain, even if a user clicks through. For organisations using Microsoft 365 or Google Workspace, applying safe-links and safe-attachments policies to all inbound mail reduces the chance of a follow-up phishing attempt succeeding after the initial payload runs.

A more proactive measure is the use of canary tokens or a decoy credential planted on a few corporate devices. If a malvertising payload runs, the token is more likely to be triggered than a real user, providing a quick signal that something has gone wrong. Several Australian managed detection providers now offer this kind of tripwire as a standard service.

Long-term defences for Australian organisations

Stopping malvertising entirely is unrealistic, but reducing exposure is achievable with a layered approach. Below is a comparison of common defensive measures, their relative cost, and how they fit a typical Australian mid-market organisation.

Control	Cost to deploy	Time to value	Coverage against malvertising	Typical fit in Australia
Brand and ad monitoring	Low–Medium	Days	High (pre-click)	Marketing and security teams working together
DNS filtering for new domains	Low	Hours	Medium	Easy roll-out across SMB and enterprise
Behavioural endpoint detection	Medium	Weeks	High (post-click)	Standard for any organisation with EDR budget
Application allow-listing	Medium–High	Months	Very High	Best for high-assurance environments, e.g. government suppliers
User awareness training	Low	Weeks	Medium	Useful across all sectors, especially customer-facing staff
Browser isolation	High	Weeks	Very High	Common in financial services and critical infrastructure

For organisations looking to benchmark their endpoint coverage against current malware families, a side-by-side review of available products at antivirus software ratings can help narrow the field. The right choice will depend on the operating systems in play, the maturity of in-house security operations, and the regulatory regime the business operates under.

A useful rule of thumb is to combine two complementary controls from the table, such as DNS filtering paired with behavioural endpoint detection. That pairing catches the bulk of payloads, including the loader-only campaigns that try to slip past signature-based antivirus engines. For organisations that hold sensitive personal data, adding browser isolation on top gives a near-complete shield against drive-by infections from search-result redirects.

Practical steps to reduce risk this quarter

The following measures can be implemented without major capital outlay and will meaningfully reduce the chance of a malvertising incident turning into a breach.

• Register look-alike domains for top brand names, including common .com.au variants, and park them on a holding page.
• Subscribe to a brand-protection or ad-monitoring service that covers Google Ads in Australia, and route alerts to your security operations queue.
• Apply DNS filtering at the resolver to block newly registered domains for at least 30 days, with an exception process for legitimate business needs.
• Roll out a behavioural EDR agent to every corporate endpoint, including contractor laptops, and review detections weekly.
• Run a short awareness session with staff who search for downloadable utilities, finance tools, or software updates, using real Australian malvertising lures.
• Establish an internal process for reporting suspicious sponsored search results, including who contacts Google, who notifies legal, and who updates the brand-protection vendor.

These steps will not eliminate the threat, but they will shrink the window of exposure and make Australian organisations a harder target. With the ACSC continuing to flag search-engine abuse as a leading vector, hardening paid-search monitoring is overdue.