Google searches are becoming a bigger target of cybercriminals with the rise of ‘malvertising’

Published

10 months ago

September 5, 2024

admin

Hackers are increasingly using online ads for malicious purposes. Often, it’s happening through routine Google searches.

These schemes are dubbed malvertising, and cyber criminals are striking more often and with increased sophistication. In fall 2023, cybersecurity software firm Malwarebytes tracked a 42% increase month-over-month in malvertising incidents in the U.S. All types of brands are being targeted, whether it’s for phishing purposes or for actual malware, said Jérôme Segura, senior director of research at Malwarebytes. “What I’m seeing is just the tip of the iceberg,” he said.

Many of these rogue ads appear as sponsored content during a search engine query on a desktop or mobile device. But malicious code can also be hidden in ads that appear on mainstream websites consumers routinely visit. Some of these ads will only ensnare consumers who click on them, but in some cases, people can be vulnerable in a more passive way — sometimes just by visiting an infected site, said Erich Kron, security awareness advocate for KnowBe4, a security awareness and training company.

Corporate employees can also be targets of malvertising, Segura said. He cited a few actual examples that were recently uncovered involving big companies. Lowe’s staff members were targeted via a Google ad for an employee portal claiming to be associated with the retailer. Clicking on the link, “myloveslife.net,” which contains a misspelling of the company’s name, took users to a phishing page with Lowe’s logo. This had the potential to confuse employees since many don’t know offhand the URL for their internal website. “You see the brand, even the official logo of that brand, and for you it’s enough to think it’s real,” Segura said.

Segura also cited an ad meant to impersonate Salesforce-owned communication tool Slack. Initially, by clicking on the ad, he was redirected to a price page on Slack’s official website. But suspecting bad actors were at play, Segura dug deeper and uncovered an impersonation ploy, which involved trying to convince unsuspecting users to download something purporting to be the Slack app.

It’s not Google’s fault, but don’t trust it

Malvertising is not new, but cybercriminals are getting smarter and the ads are often so realistic that it’s easy to be duped. The problem is exacerbated by the fact that so many people use and trust Google as a search engine, where many of the malicious ads can be found. It’s not a problem with Google, per se; malicious ads can also show up in queries using other search engines like Microsoft’s Bing. It’s just that Google is such a widely used search engine and people trust it and let their guard down. “You see something appearing on a Google search, you kind of assume it is something valid,” said Stuart Madnick, professor of information technology at MIT Sloan School of Management.

Consumers can also fall prey to malicious ads on trusted websites they visit regularly. Many of these ads are legitimate, but some bad ones can slip through the cracks. “It’s like the post office. Does the mailman check every letter you get to make sure it’s really from Publishers Clearing House?” Madnick said.

Be very careful about where and when you click

Consumers can take steps to protect themselves against malvertising attempts. For instance, they should avoid clicking on sponsored links that come up during an internet search. Often, the first ad below the sponsored one will be the product they are looking for, and since it isn’t sponsored, there’s less chance of being sidelined by malicious code or a phishing attempt.

If you do click on a sponsored link, check the URL at the top of the web page to make sure it’s really where you meant to be before taking any other actions. For example, if you’re trying to visit Gap.com, make sure you’re not really on Gaps.com. Consumers who find themselves on a suspicious site should close the window immediately, said Avinash Collis, assistant professor at Carnegie Mellon University’s Heinz College. In most cases, this will avoid further trouble, he said.

Consumers also need to be careful about clicking ads they see on trusted websites, Kron said. They may, for instance, see ads for products that are much lower in cost than elsewhere. But Kron recommends not clicking and instead visiting the trusted website of the product seller. Most of the time, consumers will be able to search on the provider’s site if a special deal exists, or the deal will be highlighted on the main page of the trusted website, he said.

Also avoid calling a telephone number listed in a sponsored ad because it could be a fake telephone number. If you call it, cyber thieves could gain access to your computer or your personal information, depending on the scheme, said Chris Pierson, CEO of BlackCloak, a cybersecurity and privacy platform that provides digital executive protection for corporate executives.

Consumers should make sure they are calling a number from official product documentation they have in their possession, Pierson said. Alternatively, consumers could visit the company’s home page for this information. “Doing a [web] search could return results that are not sponsored by the company and telephone numbers that are associated with cybercriminals. All it takes to get an ad out there is money and, of course, cybercriminals that are stealing money, have the ability to pay for that bait,” Pierson said.

Avoid ‘drive-by-downloads’

Consumers should also make sure the operating system and internet browsers are up-to-date on their computer and mobile phone.

So-called drive-by-downloads, which can impact people who merely visit a website infected with malicious codes, generally rely on a vulnerability in the user’s browser. This is not as much of a threat for people who keep their browsers and browser extensions up-to-date, Kron said.

Consumers could also consider installing anti-malware software on their computer and phone. Another option is to avoid ads by installing an ad blocker extension such as uBlock Origin, a free and open-source browser extension for content filtering, including ad blocking. Some consumers may also opt to install a privacy browser such as Aloha, Brave, DuckDuckGo or Ghostery on their personal devices. Many privacy browsers have embedded ad blockers; consumers may still see sponsored ads, but they will see fewer of them, which minimizes the chances of malvertising.

Consumers who come across suspicious ads should report them to the applicable search engine for investigation and removal if deemed malicious, Collis said. This can help protect other people from being ensnared.

Proper safety precautions are especially important since there are millions of ads on the internet and cyber thieves are relentless. “You should assume that this could happen to you no matter how careful you are,” Madnick said.

Technology

Nintendo’s Switch 2 has powered a $39 billion rally this year

Published

6 hours ago

June 18, 2025

admin

Nintendo's Switch 2 has powered a billion rally this year

Nintendo Co. Switch 2 game consoles at a Bic Camera Inc. electronics store in Tokyo, Japan, on Thursday, June 5, 2025. Nintendo Co. fans from Tokyo to Manhattan stood in line for hours to be among the first to get a Switch 2, fueling one of the biggest global gadget debuts since the iPhone launches of yesteryear.

Kiyoshi Ota | Bloomberg | Getty Images

Nintendo shares hit a fresh record high on Wednesday, continuing this year’s massive rally that has been fueled by hype around the company’s newly released Switch 2 console.

Shares of the Japanese gaming giant have jumped 46% this year, adding roughly $39 billion to the stock’s value, according to a CNBC calculation of data from S&P Capital IQ.

The Switch 2 is the successor of the original Switch console, which was released in 2017. Nintendo unveiled details of the Switch 2 in January, and the device went on sale this month, leading to shortages of the console in some markets and even to stores operating special opening hours.

Nintendo this month said it sold 3.5 million units of the Switch 2 in the four days following its launch. The company has previously forecast sales of 15 million units in its fiscal year ending March 2026, though many analysts say that is a modest estimate and expect Nintendo to achieve higher numbers.

Nintendo’s original Switch is its second-most successful console in history, selling over 152 million units since its launch to the quarter ended March this year. Its appeal lies in its hybrid nature — users can play the console on a TV, but can also detach it to use it on the go.

Investors are hoping the Switch 2 will replicate the success of its predecessor.

Nintendo has boosted the the success of its consoles through games involving strong franchises with characters and brands like Super Mario, Zelda and Pokemon. And the company has used its recognizable intellectual property and licensed it to movies and theme parks, boosting the success of its core video game product.

For Nintendo investors, that strategy has paid off. Since March 2017, when the original Switch was released, Nintendo shares have surged nearly 470%, according to S&P Capital IQ data. More than $81 billion has been added to the company’s market capitalization over that period.

Technology

Sam Altman says Meta offered OpenAI staff $100 million bonuses, as Mark Zuckerberg ramps up AI poaching efforts

Published

8 hours ago

June 18, 2025

admin

Sam Altman says Meta offered OpenAI staff 0 million bonuses, as Mark Zuckerberg ramps up AI poaching efforts

OpenAI CEO Sam Altman speaks during the Snowflake Summit in San Francisco on June 2, 2025.

Justin Sullivan | Getty Images News | Getty Images

Meta Platforms tried to poach OpenAI employees by offering signing bonuses as high as $100 million, with even larger annual compensation packages, OpenAI chief executive Sam Altman said.

While Meta had sought to hire “a lot of people” from OpenAI, “so far none of our best people have decided to take them up on that,” Altman said, speaking on the “Uncapped” podcast, which is hosted by his brother.

“I’ve heard that Meta thinks of us as their biggest competitor,” he said. “Their current AI efforts have not worked as well as they have hoped and I respect being aggressive and continuing to try new things.”

Meta did not immediately respond to a request for comment from CNBC.

The Meta CEO is personally trying to assemble a top artificial intelligence team for its “superintelligence” AI lab and has invested heavily in AI through its Meta AI research division, which also oversees its Llama series of open-source large language models.

The moves come after Meta had once again delayed the release of its latest flagship AI model due to concerns about its capabilities, according to a report from the Wall Street Journal.

Meanwhile, sources have previously told CNBC that Zuckerberg has become so frustrated with Meta’s standing in AI that he’s willing to invest billions in top talent.

Last week Alexandr Wang, founder of Scale AI, announced he was leaving for Meta as part of a deal that saw the Facebook parent dish out $14.3 billion for a 49% stake in the AI startup. Wang added that a small number of Scale AI employees would also join Meta as part of the agreement.

What Meta's Scale AI deal reveals about the battle for top AI talent

The Times had previously reported that Wang would head a research lab pursuing “superintelligence,” an AI system that surpasses human intelligence.

The company has also recently poached other top talent, including Jack Rae, a principal researcher at Google’s AI research laboratory DeepMind, according to a report from Bloomberg. The report added that Zuckerberg had been directly involved with the recruitment efforts.

Speaking on the podcast, which was released on Tuesday, Altman said that Meta’s strategy of offering a large, upfront, guaranteed compensation would detract from the actual work and not set up a winning culture.

“I think that there’s a lot of people, and Meta will be a new one, that are saying ‘we’re just going to try to copy OpenAI,'” he added. “That basically never works. You’re always going to where your competitor was, and you don’t build up a culture of learning what it’s like to innovate.”

However, spending big on startups and their talent is nothing new to the AI space. Former Apple chief design officer Jony Ive joined OpenAI after the company acquired Ive’s AI devices startup io through a $6.4 billion all-equity deal last month.

Some tech analysts have also pushed back against the notion that Meta has been missing the mark on AI.

“They basically built the rails for open source AI development, and so much of what is happening in AI is being built on Meta,” Daniel Newman, CEO at Futurum Group, told CNBC’s “Power Lunch” last week.

Open-source generally refers to software in which the source code is made freely available on the web for possible modification and redistribution. Llama’s open-source characteristics have allowed many third-party applications to be built on top of it.

Newman added that Meta’s massive investments, such as in ScaleAI, will continue to push it forward in training its behemoth models.

Technology

Trump to extend TikTok deadline for third time, pushing decision out another 90 days

Published

15 hours ago

June 17, 2025

admin

Trump to extend TikTok deadline for third time, pushing decision out another 90 days

Muhammed Selim Korkutata | Anadolu | Getty Images

For a third time since taking office in January, President Donald Trump plans to extend a deadline that would require China’s ByteDance to divest TikTok’s U.S. business.

“President Trump will sign an additional Executive Order this week to keep TikTok up and running,” White House Press Secretary Karoline Leavitt said in a statement. “As he has said many times, President Trump does not want TikTok to go dark. This extension will last 90 days, which the Administration will spend working to ensure this deal is closed so that the American people can continue to use TikTok with the assurance that their data is safe and secure.”

ByteDance was nearing the deadline of June 19, to sell TikTok’s U.S. operations in order to satisfy a national security law that the Supreme Court upheld just a few days before Trump’s second presidential inauguration. Under the law, app store operators like Apple and Google and internet service providers would be penalized for supporting TikTok.

ByteDance originally faced a Jan. 19 deadline to comply with the national security law, but Trump signed an executive order when he first took office that pushed the deadline to April 5. Trump extended the deadline for the second time a day before that April mark.

Trump told NBC News in May that he would extend the TikTok deadline again if no deal was reached, and he reiterated his plans on Thursday.

Prior to Trump signing the first executive order, TikTok briefly went offline in the U.S. for a day, only to return after the president’s announcement. Apple and Google also removed TikTok from the Apple App Store and Google Play during TikTok’s initial U.S. shut down, but then reinstated the app to their respective app stores in February.

Multiple parties including Oracle, AppLovin, and Billionaire Frank McCourt’s Project Liberty consortium have expressed interest in buying TikTok’s U.S. operations. It’s unclear whether the Chinese government would approve a deal.

— CNBC’s Kevin Breuninger contributed to this report

WATCH: Project Liberty’s bid for TikTok is aligned with U.S. national security priorities.