“FakeBat malware”
we observed a malicious Google ad for KeePass, the open-source password manager which was extremely deceiving. … The malicious actors registered a copycat internationalized domain name … to masquerade as the real KeePass site. The difference between the two sites is visually so subtle it will undoubtedly fool many people.
…
The malicious advert shows up when you perform a Google search for ‘keepass’, the popular open-source password manager. The ad is extremely deceiving as it features the official KeePass logo, URL and is featured before the organic search result for the legitimate website.
…
While the decoy site is not an exact replica of the real one, it still looks very convincing. … Extracting the installer’s content reveals malicious PowerShell code that belongs to the FakeBat malware family.

“ķeepass”
A Google Ads campaign was found pushing a fake KeePass download site … to distribute malware. … Even worse, Google Ads can be abused to show the legitimate domain for Keepass in the advertisements … making the threat hard to spot even for more diligent and security-conscious users.
…
The abuse of Punycode for cybercrime isn’t novel. However, its combination with Google Ads abuse can signify a new dangerous trend in the field. … Punycode is an encoding method used to represent Unicode characters, helping convert hostnames in non-Latin scripts (Cyrillic, Arabic, Greek, Chinese, etc.) to ASCII.
…
Threat actors abuse Punycode to register domain names that appear similar to legitimate sites but with one character using unicode, to look slightly different. These types of attacks are called “homograph attacks.” [These] threat actors use the Punycode “xn—eepass-vbb.info“—which converts to “ķeepass.info,” the project’s genuine domain, but with a [diacritic] underneath the character.

“Verified by Google”
There’s no way to know that it’s fake. It’s on Google, after all, which claims to vet the ads it carries.
…
Google’s Ad Transparency Center shows that the ads have been running since Saturday and last appeared on Wednesday. The ads were paid for by … Digital Eagle … an advertiser whose identity has been “verified by Google.”

Of course they were verified by Google: Google verifies identity by accepting money. Give them money, and you’re verified.
…
Honestly, it’s time for the world to move on from Google. They haven’t been safe to use as a search engine for more than two years.

Let’s Encrypt signed the cert. Getting a certificate from Let’s Encrypt is completely automated. … They are terrible for allowing lookalike sites.
…
I think support for non English ASCII characters in URLs is too big of a security risk. Maybe Let’s Encrypt shouldn’t sign certs for Punycode URLs?

Google: “Remove your ad blockers or else you can’t visit this site!”
…
Are you ****ing stupid? … This is one of the reasons we use ad blockers, Google!

Proof of concept for abusable non-Latin character URLs was done in 2001. … Ridiculous that this is still allowed. The URL shouldn’t be valid, the browser shouldn’t display it that way, and the ad should have flagged human review at Google. Everyone failed.

Keep Ass? Nope, thanks to Google’s negligence you’re going to lose it.

Recent Articles By Author