Malware Campaign Exploits Google Ad Infrastructure to Evade Detection

Huntress researchers identified a coordinated malware operation that begins with spam emails containing HTML attachments designed to redirect users through Google's ad.doubleclick.net domain—a trusted Google-owned infrastructure that security systems rarely flag as suspicious. The attack chain consists of five stages utilizing JScript, PowerShell, reflective .NET loading, and in-memory execution methods to minimize forensic traces. The malware dynamically generates fake company pages by extracting real logos from the internet and gathering location and time data to increase credibility. It employs sophisticated anti-analysis techniques including checks for debugging environments, sandbox systems, and forensic tools, while also disabling Windows security monitoring through AMSI and ETW modifications. The malware injects code into legitimate Microsoft utilities like InstallUtil.exe and MSBuild.exe to blend malicious behavior with trusted processes, and establishes persistence mechanisms that survive system restarts. While the final objective remains unclear, the infrastructure suggests preparation for extensive remote intrusion activities.