Third campaign

third_campaign is a distinct criminal malvertising and phishing operation focused on abusing search advertising to impersonate Google services and compromise advertiser accounts. The activity has been assessed as possibly Eastern European based on redirect and obfuscation patterns, but attribution remains low confidence and no specific named threat actor is established. The campaign differs from other Google Ads-themed clusters by avoiding the Google Sites lure stage and instead using cloaking, fake CAPTCHA content, and heavily obfuscated redirect logic. It has used fraudulent sponsored ads themed around Google products, including Google Authenticator, to lure victims into phishing or likely malware-delivery workflows. The operation employs server-side cloaking to present benign content to bots, VPN users, and security tooling while selectively delivering malicious content to intended victims, indicating deliberate defense evasion and traffic filtering. Observed objectives include theft of Google account credentials and compromise of Google Ads advertiser accounts for subsequent abuse. Stolen accounts can be used to run additional fraudulent ads, propagate further account compromise, and support broader malvertising or malware distribution activity. The campaign therefore spans credential theft, initial access through deceptive advertising, reconnaissance and victim profiling through redirect logic and filtering, defense evasion via cloaking and obfuscation, and post-compromise abuse of hijacked advertising accounts. Malware delivery has also been observed or strongly indicated through fake software-themed lures.