Phishing Google ads impersonating Uniswap stole at least $400,000, analysts say
Security researchers say fake sponsored search results have been used to drain crypto wallets and bypass Google’s ad checks.
Hızlı Bakış
Researchers and on-chain analysts say scammers used Google phishing ads impersonating Uniswap to steal at least $400,000, part of a wider crypto-targeted malvertising campaign.
Yapay zekâ özeti
Neden Önemli?
The article describes a broader pattern of phishing attacks delivered through Google sponsored results that impersonate crypto services. It also notes similar malicious advertising activity involving Mac users and fake Microsoft promotions on Facebook.
Scammers have used Google to place malicious phishing advertisements impersonating the crypto protocol Uniswap, in a campaign that has reportedly stolen at least $400,000.
On-chain analyst “b-block” posted on X on Monday that a website posing as the decentralized finance exchange Uniswap was draining funds from multiple wallets and that the scammers were holding at least $400,000.
Stacy Muur, founder of Web3 marketing agency Green Dots, said the funds were stolen through a phishing ad on Google that impersonated Uniswap. She shared a screenshot showing a sponsored search result.
“It’s insane that Google has ignored this issue for years while fake links keep getting pushed above real ones and users keep getting drained,” she said.
According to Etherscan, the two flagged addresses held a combined 146 ETH worth about $306,000 at the time of writing.
DeFiLlama said fake ads on Google are a common source of phishing attacks. The crypto non-profit group Security Alliance, or SEAL, reported in April that there was a significant uptick in phishing activity on Google Search in March.
SEAL said attackers either pay Google directly or compromise legitimate advertiser accounts to run convincing fake ads impersonating popular crypto protocols. According to the group, threat actors outbid legitimate exchanges and protocols to secure higher placement in Google Search’s sponsored results.
SEAL said it blocked more than 356 malicious advertisement links, a figure it described as representative of a steady volume of attacker-deployed Google Ads each week for more than a year. The group said the campaign was not slowing down and that it was receiving more reports from affected users.
The phishing ads used legitimate-looking URLs to bypass Google’s automated checks, while a hidden secondary iframe loaded the malicious payload in a way that remained invisible to Google’s detection systems.
SEAL said victims were sent to convincing copies of real crypto apps, with network traffic secretly routed through attacker-controlled servers. It reported that $1.27 million was stolen between March 13 and 30.
In early May, attackers were also reported to be abusing Google Ads and legitimate shared chats from AI chatbot Claude in an active malvertising campaign targeting Mac users.
Facebook has also been identified as a major venue for fake ads and scams. Malwarebytes reported in February that scammers were running paid ads resembling official Microsoft promotions.
Those victims were directed to near-perfect copies of the Windows 11 download page, where malware designed to steal crypto assets and credentials was deployed.
Bundan Sonra Ne Olabilir?
Yapay zekâ öngörüsü — kesinlik taşımaz
More malicious ad links related to crypto impersonation are likely to be identified.
Çok muhtemel · Günler içinde
Additional user loss reports linked to sponsored phishing results may emerge.
Muhtemel · Günler içinde
Security researchers and users will continue warning about Google-sponsored phishing ads targeting crypto platforms.
Çok muhtemel · Haftalar içinde
Açık Sorular
- How many users were affected by the fake Uniswap ads?
- Whether Google removed the specific sponsored results and advertiser accounts involved?
- Which exact wallets or infrastructure were used by the attackers beyond the flagged addresses?
- Whether Uniswap issued a response or warning to users?
