Asian group

asian_group is an Asia-linked cybercriminal cluster involved in malvertising and phishing operations targeting Google Ads advertisers. The activity has been associated with the use of compromised advertiser accounts from Hong Kong and code artifacts in Chinese, suggesting an Asia-based operator set, possibly linked to China, although that attribution remains unconfirmed. The group’s objective is to steal advertiser account credentials, take over accounts, and abuse those accounts for fraudulent advertising spend and continued propagation of malicious ads. The group impersonates Google Ads through sponsored search advertisements placed via compromised advertiser accounts. Victims are redirected through Google Sites pages designed to resemble legitimate Google Ads pages and then sent to external phishing portals. The phishing infrastructure captures Google account credentials and collects additional victim telemetry through JavaScript-based fingerprinting and POST-based exfiltration. Reported downstream effects include account takeover, unauthorized administrator addition, victim lockout, and reuse or resale of compromised advertiser accounts. This cluster is distinct from a separate Brazil-linked operation and another likely Eastern European campaign observed in the same broader ecosystem. High-confidence reporting supports phishing, credential theft, account takeover, and exfiltration as core behaviors. Financial gain is the dominant motivation.