This new cybercrime platform lets hackers run malicious Google Ads and hide from Google's screening process

• Varonis uncovered 1Campaign, a cloaking tool for malicious Google Ads
• Shows phishing/scam content to victims, blank pages to reviewers and scanners
• Offers analytics, visitor profiling, fraud scoring, and brand spoofing at scale

For three years, someone has been selling a tool that allows crooks to run malicious Google Ads which are only served to highly relevant targets.

Security researchers Varonis dubbed the service 1Campaign, and in an in-depth report, described 1Campaign as a “cloaker”, through which malicious actors can show different content to different visitors.

While real victims see actual phishing or scam content, security researchers, ad platform reviewers, and automated scanners, see a basic blank page. “This allows fraudulent Google Ads campaigns to pass initial review and stay active longer before being flagged,” Varonis explained.