The attackers used a variety of techniques to get around Google AdSense audits, including regional targeting and page-switching.
Scammers used a wallet draining service called “MS Drainer” to siphon approximately $59 million in crypto from victims over the past nine months, according to a Dec. 21 report on X (formerly Twitter) from blockchain security platform Scam Sniffer. The scammers used Google Ads to target victims with fake versions of popular crypto sites, including Zapper, Lido, Stargate, DefiLlama, Orbiter Finance and Radient, the report states.Wallet drainers are blockchain protocols that allow scammers to transfer crypto from a victim to the attacker without their consent, usually by exploiting the token approval process. Developers usually charge a percentage of the profit in exchange for using their drainer software, and this fee is enforced through smart contracts, making it impossible to avoid.Scam Sniffer first became aware of MS Drainer in March. At the time, the SlowMist security platform team helped with the investigation. In June, on-chain sleuth ZachXBT provided further evidence, uncovering a phishing scam called “Ordinal Bubbles” that was linked to the drainer. The investigators uncovered nine different phishing ads on Google, 60% of which used the malicious program.

Under normal circumstances, Google uses auditing systems to prevent phishing scam ads from being posted. However, Scam Sniffer found that the scammers used “regional targeting and page-switching tactics to bypass ad audits, complicating the review process” and allowing their ads to get through Google’s quality control systems.

The scammers also used web redirects to fool Google’s users into thinking links led to official websites. For example, the scam site cbridge.ceiler.network, which contains a misspelling of the word “Celer,” was disguised as the correct URL: cbridge.celer.network. Despite the correct spelling being displayed on the ad, the link nevertheless redirected the user to the incorrectly spelled scam site.

Source - CoinTelegraph