Loading story…
Sophos reported that a malvertising campaign used bad ads to lure users into downloading malware, leading to infections with the banking trojans IcedID and Gozi. The activity shows threat actors continuing to abuse online advertising as an initial access vector, using deceptive ads and likely fake download or redirect chains to place malware on victim systems.
The infections are significant because both IcedID and Gozi have long been associated with credential theft, financial fraud, and follow-on compromise. The campaign highlights the ongoing risk posed by poisoned search results and malicious advertisements, where a single user click can expose organizations to malware capable of stealing banking information, harvesting credentials, and enabling broader intrusion activity.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos published research describing a malicious advertising campaign that resulted in IcedID and Gozi malware infections. No additional event details or earlier dates are provided in the reference content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malicious Google search advertisements were used to impersonate legitimate software and brand websites, steering users to spoofed download pages that delivered **IcedID** malware. In one documented chain, a search for AnyDesk led through Google ad infrastructure and a traffic distribution system to a fake site, `wwwanydesk[.]top`, which served a ZIP archive from Google Firebase Storage containing an MSI installer. The installer abused `rundll32.exe` to launch a malicious DLL export named `init`, installing IcedID through modified legitimate DLLs such as `sqlite3.dll`, `tcl86.dll`, `libcurl.dll`, and `ConEmuTh.x64.dll` to evade detection. Researchers and U.S. law enforcement said the campaign relied on pay-per-click malvertising, cloned websites, and lookalike domains that appeared prominently in search results with little visual distinction from legitimate links. After infection, compromised hosts contacted multiple IcedID command-and-control servers and in some cases pulled follow-on payloads tied to **Cobalt Strike**, **Sliver**, and **DonutLoader**, underscoring the risk of data theft and ransomware. The FBI warned that the same ad-abuse tactic is also being used to steal credentials and cryptocurrency funds, and urged users to verify URLs, avoid downloading software through ads, and report incidents to **IC3**.
Aug 15, 2026
The **Gozi/Ursnif/ISFB** banking trojan remained an active cybercrime threat across Europe and Japan, spreading mainly through targeted malspam and phishing emails carrying weaponized Word, XLS, ZIP, JavaScript, HTA, and macro-enabled attachments. Multiple campaigns used staged infection chains involving VBA macros, PowerShell, `rundll32`, HTA downloaders, and side-loaded DLLs, with distribution tied in some cases to the **Dark Cloud** botnet and other spam infrastructure. Researchers also observed related delivery through Shiotob downloaders and compromised web servers, with operators rotating domains, IPs, and lure content to reduce detection while targeting both retail and corporate banking users.
Aug 15, 2026
Threat researchers reported two active intrusion patterns aimed at stealing credentials and maintaining access: a malvertising campaign that impersonated software brands such as **Notion** in Google search ads to deliver **Rhadamanthys** on Windows and **Atomic Stealer** on macOS, and a separate cyber-espionage operation by **Mantis** (also tracked as **Arid Viper**, **Desert Falcon**, and `APT-C-23`) targeting organizations in the Palestinian territories. In the malvertising chain, victims were redirected through intermediary domains, screened with browser-based anti-VM checks, and sent to fake download pages; the Windows installer fetched its payload from a URL hosted on TextBin, while researchers linked the advertiser account to “BUDNIK PAWEŁ” in Poland and noted thousands of views of the staging URL.
Jun 29, 2026