Google Search Ads Impersonated Software Brands to Deliver IcedID Malware

Malicious Google search advertisements were used to impersonate legitimate software and brand websites, steering users to spoofed download pages that delivered IcedID malware. In one documented chain, a search for AnyDesk led through Google ad infrastructure and a traffic distribution system to a fake site, wwwanydesk[.]top, which served a ZIP archive from Google Firebase Storage containing an MSI installer. The installer abused rundll32.exe to launch a malicious DLL export named init, installing IcedID through modified legitimate DLLs such as sqlite3.dll, tcl86.dll, libcurl.dll, and ConEmuTh.x64.dll to evade detection.

Researchers and U.S. law enforcement said the campaign relied on pay-per-click malvertising, cloned websites, and lookalike domains that appeared prominently in search results with little visual distinction from legitimate links. After infection, compromised hosts contacted multiple IcedID command-and-control servers and in some cases pulled follow-on payloads tied to Cobalt Strike, Sliver, and DonutLoader, underscoring the risk of data theft and ransomware. The FBI warned that the same ad-abuse tactic is also being used to steal credentials and cryptocurrency funds, and urged users to verify URLs, avoid downloading software through ads, and report incidents to IC3.