Loading story…
Researchers detailed Trojan-Clicker.Win32.Magala, a malware family that infects Windows systems to generate fraudulent search traffic and advertising clicks. The malware checks the installed Internet Explorer version and will not run on IE 8 or earlier, then creates a virtual desktop, establishes persistence, contacts a hardcoded command URL, and installs related adware components. It also manipulates web content through the IHTMLDocument2 interface and installs the MapsGalaxy Toolbar, changing the browser home page to hp.myway.com.
Once active, Magala downloads plaintext search-query lists from a remote server, submits those searches, and clicks the first 10 results at 10-second intervals to inflate traffic and ad revenue. The activity primarily harms advertisers—particularly small businesses paying for illegitimate visits—while infected users’ systems are covertly abused as automation platforms. Observed infections were concentrated most heavily in Germany and the United States.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The Securelist analysis states that Trojan-Clicker.Win32.Magala infections were observed most often in Germany and the United States during the period from March to early June 2017. The malware was described as a click-fraud threat that inflated advertising clicks and search-result traffic.
Securelist published an analysis detailing how Magala checks Internet Explorer versions, creates a virtual desktop, establishes persistence, installs adware components including MapsGalaxy Toolbar, and automates fraudulent search-result clicks. The report also identified advertisers, especially small businesses paying for ads, as the primary victims of the scheme.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malicious Google search advertisements were used to impersonate legitimate software and brand websites, steering users to spoofed download pages that delivered **IcedID** malware. In one documented chain, a search for AnyDesk led through Google ad infrastructure and a traffic distribution system to a fake site, `wwwanydesk[.]top`, which served a ZIP archive from Google Firebase Storage containing an MSI installer. The installer abused `rundll32.exe` to launch a malicious DLL export named `init`, installing IcedID through modified legitimate DLLs such as `sqlite3.dll`, `tcl86.dll`, `libcurl.dll`, and `ConEmuTh.x64.dll` to evade detection. Researchers and U.S. law enforcement said the campaign relied on pay-per-click malvertising, cloned websites, and lookalike domains that appeared prominently in search results with little visual distinction from legitimate links. After infection, compromised hosts contacted multiple IcedID command-and-control servers and in some cases pulled follow-on payloads tied to **Cobalt Strike**, **Sliver**, and **DonutLoader**, underscoring the risk of data theft and ransomware. The FBI warned that the same ad-abuse tactic is also being used to steal credentials and cryptocurrency funds, and urged users to verify URLs, avoid downloading software through ads, and report incidents to **IC3**.
Aug 15, 2026
A cloud-hosted tech-support scam campaign used more than 250 Google Ads campaign IDs to route users through a benign-looking fake “ShopEase” storefront before presenting operating-system-specific security lockers impersonating Microsoft Defender on Windows and Apple on macOS. Between August 31 and September 14, it affected at least 619 organizations, chiefly in the United States, Japan, and Australia, with ads appearing across at least 284 legitimate publisher sites. Victims were pressured to call a fraudulent support number through full-screen browser takeovers, keyboard locking, hidden cursors, warning audio, and intentional browser-performance degradation. The campaign reflects advanced browser-based scareware techniques also documented in CypherLoc, which uses encrypted JavaScript loaders to validate, decrypt, and execute concealed payloads before replacing the initial page with a fake security warning. Such lockers evade automated inspection through interaction checks such as required mouse movement and staged AES decryption of command-and-control details and payloads, while assembling the malicious interface entirely in browser memory. They can further heighten credibility by displaying a victim’s public IP address and fake login forms, while repeatedly relocking the browser when users attempt to recover control.
Sep 28, 2026
Push Security reported a new **ClickFix-style** social-engineering campaign dubbed **InstallFix** that uses **Google-sponsored search ads** to drive developers to near-identical cloned “install” pages for *Anthropic Claude Code* and similar AI coding tools. Victims are prompted to copy/paste terminal commands from the fake pages; executing them installs **Amatera Stealer**, enabling credential theft and potential access to enterprise development environments. Separate reporting highlighted adjacent browser-based tradecraft: a previously legitimate Chrome extension (*QuickLens – Search Screen with Google Lens*) with roughly **7,000 users** was updated to deploy **ClickFix** attacks, strip web security headers, and steal cryptocurrency wallet seed phrases before being removed from the Chrome Web Store. A weekly threat bulletin also noted unrelated incidents (e.g., ransomware and data breaches) and separate AI-themed malicious extensions that harvest LLM chat histories, but those items are not part of the InstallFix/Claude Code malvertising campaign itself.
Jul 12, 2026