Contents
- What you need before you click anything
- Step 1 — Separate the "Sponsored" label from the real result
- Step 2 — Compare the displayed URL character by character
- Step 3 — Check the whole domain, not just a familiar-looking piece
- Step 4 — Skip the ad and type the address yourself
- Step 5 — Let an ad blocker remove the decision
- Where this trips people up — and why the fake ad can outrank the real site
- If you already downloaded or ran the file
- FAQ
Sponsored Google ads have been hijacking real advertiser accounts to push malware disguised as 7-Zip, Notepad++, Microsoft Office and even the AI coding tool the same setup. Bitdefender researcher Ionut Baltariu tied at least 35 compromised advertiser accounts to one Mac-targeting campaign alone. Most security writeups explain this to IT teams. This one is for the person about to click “Download” after a normal search.
What we checked ourselves
These numbers come from our own checks run on 2026-09-13 23:43 KST.
We personally opened the 10 tools and official documents that people actually use to verify Google ad authenticity, and all 10 (10/10) responded normally today (HTTP 200).
Method: We sent an actual request to each URL in the form curl -s -o /dev/null -w '%{http_code}' -L –max-time 15 -A '<Chrome UA>' <URL> and recorded the HTTP status code. This is a single snapshot as of 2026-09-13 23:43 KST (Korea Standard Time). Redirects were followed with -L.
| Tool/Document | URL | Status code |
|---|---|---|
| Google Ads Transparency Center | adstransparency.google.com | 200 |
| Google Safe Browsing site status lookup | transparencyreport.google.com/safe-browsing/search | 200 |
| VirusTotal URL/file scan | virustotal.com/gui/home/url | 200 |
| urlscan.io | urlscan.io | 200 |
| ICANN Lookup (WHOIS) | lookup.icann.org | 200 |
| Google Ads Help: advertiser identity verification guide | support.google.com/google-ads/answer/9843535 | 200 |
| Google Ads Policy: advertiser verification | support.google.com/adspolicy/answer/9703665 | 200 |
| Google Ads Help: how to report an ad | support.google.com/google-ads/answer/7660847 | 200 |
| My Ad Center Help: advertiser verification guide | support.google.com/My-Ad-Center-Help/answer/12155361 | 200 |
| My Ad Center (personal ad settings) | myactivity.google.com/product/myadcenter | 200 |
Caveat: HTTP 200 only means 'the page loads' — it is not a guarantee that the actual data inside (such as ad search results) works correctly. Some sites, including the Ads Transparency Center, render their data with JavaScript, so curl/direct access could not confirm the actual search result content. As this is a single snapshot, responses may vary depending on the time and location (e.g. VPN) of access.
Two official documents explaining Google's 'advertiser identity verification' policy describe its scope differently — one does not mention country scope at all, while the other explicitly states that it 'currently starts in the U.S. and will expand over several years.'
Method: We opened both official Google Support pages ourselves today and compared their body text. (1) support.google.com/adspolicy/answer/9703665 (2) support.google.com/google-ads/answer/9843535. The sentences relating to applicable countries and rollout timing were quoted verbatim from each page.
| Document | Mention of country/region scope | Verbatim quote |
|---|---|---|
| adspolicy/answer/9703665 (Ads Policy: advertiser verification) | No mention | "As a part of a gradual rollout of Google's transparency efforts, all advertisers will eventually be required to complete advertiser verification." (no country specified) |
| google-ads/answer/9843535 (advertiser identity verification guide) | States a phased rollout starting in the U.S. | "We will start by verifying advertisers in phases in the U.S. and continue to expand globally… We expect it will take a few years to cover all current advertisers globally." |
Caveat: Both documents were checked as a snapshot 'as of today,' and Google updates its document content from time to time. In other words, so readers do not mistake a 'verification badge' for 'every advertiser worldwide has already been vetted,' the fact that verification may not yet be mandatory outside the U.S. only becomes clear by comparing these two documents directly — it is easy to miss if you look at each document on its own without a summary.
What you need before you click anything
You don’t need special software for this — just five minutes and a habit of slowing down before the download. Keep these three things in mind before you search for anything you’re about to install:
– The exact official domain of the software you want (write it down or bookmark it in advance) – A willingness to type a URL by hand instead of clicking the first result – Five extra minutes, because every check below takes seconds but skipping all of them takes none
That’s the whole toolkit. Nothing to install. I’d rather spend five minutes than reinstall an operating system, and that trade is the entire point of this guide.
Step 1 — Separate the “Sponsored” label from the real result
Search engine results pages mix paid ads with organic listings, often with the official site sitting just below the ad. Google marks paid placements with a “Sponsored” or “Ad” tag. Before you click anything, find that label and mentally set the ad aside. The real, organic listing for the software you want is usually a line or two down. If you only remember one habit from this article, make it this one: scroll past the labeled ad first.
Step 2 — Compare the displayed URL character by character
Most browsers show the destination URL under or near the ad text before you click. Read it slowly. In one documented case, attackers registered “ads.mcrosoftt[.]com” — missing an “i,” with an extra “t” — to impersonate the real “ads.microsoft[.]com” login page. The Hacker News reported that campaign in February 2025; Malwarebytes researcher Jérôme Segura found it. The fake page captured usernames, passwords, and even two-factor authentication codes in real time.
That’s a single swapped letter deciding whether your account survives the click.
Step 3 — Check the whole domain, not just a familiar-looking piece
A domain can contain a recognizable brand name and still not belong to that brand. Bitdefender Labs reported in March 2026 that a campaign impersonating Anthropic’s the same setup tool hosted a fake documentation page on a Squarespace subdomain — something that reads as legitimate at a glance because it borrows a well-known platform’s name. Always look at the full domain, right through to the end, not just the part that looks familiar. A subdomain hosted on a shared platform proves nothing about who controls it.
Step 4 — Skip the ad and type the address yourself
The safest version of all of this is to not click the ad at all. Type the software maker’s address directly into the address bar, or use a bookmark you saved when you were certain it was the right site. This matters even more for anything tied to money or work credentials — banking portals, cloud consoles, company logins — where a single mistyped click can hand over a session. Build the bookmark habit now, before you need it under time pressure.
Step 5 — Let an ad blocker remove the decision
A reputable ad-blocking browser extension can hide sponsored results outright, so there’s nothing to misjudge in the first place. It isn’t a complete fix — some malicious pages still slip through other channels — but removing the ad from view removes the decision entirely.
| Case | Target | Method | Reported |
|---|---|---|---|
| MacSync Stealer campaign | 7-Zip, Notepad++, LibreOffice, Microsoft Office, and other Mac software | Sponsored ad → shared Evernote “tutorial” page → copy-paste Terminal command | Feb 18, 2026 (Bitdefender) |
| the same setup impersonation | the same setup (Anthropic) | Sponsored ad → fake Squarespace-hosted docs page → terminal command, Windows and Mac | Mar 11, 2026 (Bitdefender Labs) |
| Microsoft Advertising phishing | Microsoft Ads login accounts | Sponsored ad → typosquat login page capturing password and 2FA | Feb 1, 2025 (The Hacker News) |
| Multi-brand malvertising | Grammarly, Slack, Dashlane, and 10 other brands | Sponsored ad → fake download page → info-stealing malware | Dec 28, 2022 (BleepingComputer, background case) |
Where this trips people up — and why the fake ad can outrank the real site
Here’s the part other coverage skips: how a scam ad manages to beat the real company’s own search ranking. Bitdefender found that the Mac-targeting campaign didn’t rely on brand-new advertiser accounts — it ran through at least 35 accounts that had already been compromised, spread across 15 countries: the US, Canada, Italy, Poland, Brazil, India, Saudi Arabia, Japan, China, Romania, Malta, Slovenia, Germany, the UK, and the UAE. The the same setup campaign reportedly used a hijacked account belonging to a real company based in Malaysia. An account with existing ad history and spending doesn’t get the same fresh scrutiny a brand-new account does — which is a plausible reason hijacked accounts clear review more easily than new ones, though the exact mechanics of Google’s ranking and review process weren’t disclosed in the reporting, so treat that as an educated guess rather than a confirmed rule.
There’s an irony worth sitting with here. A Mac developer using the handle RACE wrote about spending $500 on Google Ads for a legitimate, code-signed and notarized terminal app, only to have the account suspended under Google’s “Malicious software” and “Compromised Site” policies — despite the app passing Google Safe Browsing checks and returning a clean VirusTotal scan. The developer called it a Catch-22: Google never specified what was actually flagged, and repeated appeals were denied, ending with a notice to submit new information or delete the account. That case doesn’t excuse the malvertising campaigns above. But it’s a sign that Google’s ad review can misfire in both directions — blocking real software while letting hijacked accounts push malware through the same system. I wouldn’t take either failure as reassurance that the other one is under control.
The clearest tell across the malware campaigns is the delivery method itself. Both the Mac software campaign and the the same setup campaign relied on what’s called “ClickFix” — a fake tutorial page that walks you through copying a Base64-encoded command and pasting it into Terminal or a Windows run box yourself. Legitimate installers essentially never ask you to do that. If a “help” page tells you to paste something into a terminal to install ordinary desktop software, stop there.
If you already downloaded or ran the file
Don’t run it if you haven’t already — that’s the whole point of the checks above. If you have already run it, here’s the order that matters:
- Disconnect from Wi-Fi or unplug the ethernet cable immediately, to cut off any data leaving the machine or new commands arriving.
- Run a full scan with a reputable antivirus or anti-malware tool.
- Assume anything stored in your browser — saved passwords, crypto wallet access, login tokens — may be exposed. Bitdefender’s analysis of the the same setup campaign’s Mac payload specifically found it built to grab credentials, browser data, and crypto-related information, so this isn’t a hypothetical. Change those passwords from a different, clean device, not the infected one.
- If you’re not confident the machine is clean afterward, a full OS reinstall is the more certain fix.
Where things get messier is knowing which step applies to your specific setup — a work laptop with IT-managed antivirus is a different situation than a personal machine with nothing installed. If in doubt, working through the list above in order, top to bottom, is the safest default.
FAQ
Are all sponsored Google ads dangerous? No. Most sponsored results come from legitimate businesses paying for placement — sponsorship itself isn’t the problem. The risk documented in these cases came specifically from hijacked advertiser accounts and typosquatted domains riding on top of that same ad system, not from paid search as a concept.
What’s the fastest single check I can do before clicking? Read the displayed URL under the ad and compare it letter by letter against the software maker’s real domain. That one habit would have caught the “mcrosoftt.com” typosquat documented by The Hacker News, and it takes a few seconds.
Is Google fixing this? Google told The Hacker News it was aware of the Microsoft Ads phishing campaign and was taking action, but the report didn’t include specifics on what that action was. Whether that translates into fewer hijacked-account campaigns generally isn’t confirmed by the sources here — treat it as an acknowledgment, not a resolved problem.
What’s still unclear is how many of these hijacked-account campaigns are running at any given moment — the cases above are the ones researchers happened to catch and publish, not a full count. The next thing worth watching is whether Google tightens review specifically for accounts that suddenly change what they’re advertising, since that’s the pattern showing up across more than one of these cases. Until then, the five-minute habit of checking the domain before you click is the part you control.
Image credits
- Photo by TREEDEO.ST on Pexels
- Photo by Fernando Arcos on Pexels
- Photo by Rafael Minguet Delgado on Pexels