Malvertising Campaign Delivered IcedID and Gozi Banking Malware

Sophos reported that a malvertising campaign used bad ads to lure users into downloading malware, leading to infections with the banking trojans IcedID and Gozi. The activity shows threat actors continuing to abuse online advertising as an initial access vector, using deceptive ads and likely fake download or redirect chains to place malware on victim systems.

The infections are significant because both IcedID and Gozi have long been associated with credential theft, financial fraud, and follow-on compromise. The campaign highlights the ongoing risk posed by poisoned search results and malicious advertisements, where a single user click can expose organizations to malware capable of stealing banking information, harvesting credentials, and enabling broader intrusion activity.