Malware Distribution via Google PPC by IcedID Botnet Distributors

Threat Level

Attack Report

For a detailed threat advisory, download the pdf file here

Summary

The IcedID botnet has been using Google pay-per-click ads to distribute itself through malvertising attacks since December 2022. Malvertising involves the use of malicious ads that are displayed in search results and lure users into downloading malware. In these attacks, keywords are hijacked to display malicious ads that lure users into downloading the malware.