Google Ads Abused to Lure Corporate Workers to LOBSHOT Backdoor

The cyberattack campaign, similar to one to spread the Rhadamanthys Stealer, is part of a larger trend by attackers to use malvertising as initial access for ransomware and other threat activity.

A newly discovered backdoor and credential-stealer is posing as a legitimate software download as part of an elaborate campaign to lure corporate workers into downloading malware.
Researchers from Elastic Software observed the malware, dubbed LOBSHOT, being propagated through malicious Google Ads for popular remote-workforce applications like AnyDesk, they disclosed in a
recent blog post.
Attackers promoted their malware using an elaborate schemed of fake websites through Google Ads and embedding backdoors in what appears to users as legitimate installers, Elastic Softwares Daniel Stepanic wrote in the post.
Moreover, the threat group TA505, known for spreading the
Clop ransomware
, appears to be behind LOBSHOT, a backdoor that appears financially motivated, stealing banking, crypto, and other credentials and data from victims, the researchers said. The fake download site used to spread LOBSHOT executed a DLL from download-cdn[.]com, a domain historically associated with the threat group — also known for its hand in the
Dridex
, Locky, and Necurs campaigns, they said.
Based on this other infrastructure tied to TA505 thats used in the campaign, the researchers assess with moderate confidence that LOBSHOT is a new malware capability leveraged by the group, Stepanic wrote. Moreover, researchers are seeing new samples related to this family each week, and expect it to be around for some time, he wrote.
Like similar threat campaigns observed earlier in the year, potential victims are exposed to LOBSHOT by clicking on Google Ads that purport to be for legitimate workforce software, such as AnyDesk. This tactic is similar to
one observed in January
spreading the malware-as-a-service Rhadamanthys Stealer through website redirects from Google Ads that also posed as download sites for popular remote-workforce software, such as AnyDesk and Zoom.
Indeed, the campaigns are linked to a large spike in the adoption of malvertising that security researchers have been observing since earlier this year, according to Elastic Search.
Similar infection chains were observed in the security community with commonalities of users searching for legitimate software downloads that ended up getting served illegitimate software from promoted ads from Google, Stepanic wrote.
The activity reflects a trend of adversaries persistence in abusing and increasing their reach through malvertising such as Google Ads by impersonating legitimate software, he said.
Stepanic acknowledged that these types of malware may seem insignificant and have limited reach, but they end up packing a big punch through fully interactive remote control capabilities to help threat actors gain initial access to corporate networks and engage in other malicious activity.
The LOBSHOT infection chain begins when someone performs an Internet search for a legitimate software for which Google Ads delivers a promoted result that is actually a malicious site.
In
one observed instance
, the malicious ad was for a legitimate remote desktop solution, AnyDesk, Stepanic explained. Careful examination of the URL goes to https://www.amydecke[.]website instead of the legitimate AnyDesk URL,
https://www.anydesk.com
.
Clicking on that ad leads the user to a legitimate-looking landing page for a download for the software that the user was seeking. However, its actually an MSI installer that, once downloaded, executes on the users computer, the researchers said.
The landing pages were very convincing, with similar branding as the legitimate software and included Download Now buttons that pointed to an MSI installer, Stepanic wrote.
MSI then launches a PowerShell that downloads LOBSHOT via rundll32, which begins communication with the attacker-owned command-and-control server, according to Elastic Software.
One of LOBSHOTs core capabilities is around its hVNC (Hidden Virtual Network Computing) component, a module that allows for direct and unobserved access to the machine, and is used by attackers as a way to evade detection, Stepanic noted.
This feature continues to be successful in bypassing fraud-detection systems and is often baked into many popular families as plugins, he wrote.
Like most malware used currently, LOBSHOT also employs dynamic import resolution to evade security products and slow down the rapid identification of its capabilities, the researchers said.
This process involves resolving the names of the Windows APIs that the malware needs at runtime as opposed to placing the imports into the program ahead of time, Stepanic wrote.
Researchers included links to various Elastic Search GitHub pages that demonstrate prevention tactics to avoid compromise by malware such as LOBSHOT related to its various processes, including
Suspicious Windows Explorer Execution
,
Suspicious Parent-Child Relationship
, and
Windows.Trojan.Lobshot
.
The post also includes directions that organizations can use to create EQL queries to hunt for similar suspicious behaviors related to the grandparent, parent, and child relationships that the researchers observed LOBSHOT executing.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Google Ads Abused to Lure Corporate Workers to LOBSHOT Backdoor