Why Are Google Ads Still Serving Dodgy Ads?
Key Takeaways
- Google removed 8.3 billion ads in 2025, up from 5.1 billion in 2024, but suspended fewer advertiser accounts, shifting enforcement from accounts to individual ads.
- Cloaking platforms such as 1Campaign show harmless pages to reviewers and scanners, then serve phishing or malware to real users.
- NYU and Radboud researchers found 238 scareware ads and 3,346 false-claim ads in Google’s own transparency archive, drawing over 100 million impressions in Europe.
- Reporting a bad ad often fails: 42 ads pointed at one malicious domain and only one was taken down.
- Some campaigns now point ads at genuine domains like claude.ai, so there is no lookalike URL to spot.
Google blocked a record 8.3 billion ads globally in 2025, up from 5.1 billion the year before, according to TechCrunch’s review of Google’s 2025 Ads Safety Report. It suspended far fewer advertiser accounts than that surge suggests. Google now removes more individual ads while banning fewer of the actors behind them, and the actors keep returning.
Keerat Sharma, Google’s VP and general manager of ads privacy and safety, said the company enforces rules “at a much more granular level, on the creative level, as opposed to using a much more blunt instrument, like advertiser suspensions.” Google says its AI systems caught more than 99% of policy-violating ads before they ran. The fraction that slips through is where malware appears.
The Numbers That Do Not Add Up
Google removed 602 million scam-related ads and suspended 4 million advertiser accounts linked to scams in 2025, per the same TechCrunch report. In the United States it removed 1.7 billion ads and suspended 3.3 million accounts, with ad network abuse and misrepresentation the top two violations. In India, its largest market by users, it blocked 483.7 million ads, nearly double the prior year, even as account suspensions fell to 1.7 million from 2.9 million.
The Genuine Domain Problem
Google presents the declining suspension count as success, saying its AI models reduced incorrect advertiser suspensions by 80% year over year. That is an improvement for legitimate advertisers previously caught in automated sweeps. It also means enforcement now treats an ad as clean or dirty based on its own content, independent of who placed it.
Cloaking breaks that assumption. If the same advertiser serves a benign page to Google’s reviewer and a malicious page to the real user, creative-level review only ever sees the benign version. The account stays in good standing because, from Google’s perspective, it never did anything wrong.
How Cloaking Defeats the Review Process
Varonis Threat Labs documented a platform called 1Campaign built to help attackers pass Google Ads screening and stay live longer, according to Varonis’s analysis. It combines visitor filtering, fraud scoring, geographic targeting, and a bot guard script generator in a single dashboard. Its developer, operating under the handle DuppyMeister, has maintained it for over three years with dedicated Telegram support channels.
Varonis found that traffic from Microsoft Corporation, Google, Tencent Cloud Computing, and OVH Hosting is automatically flagged with high fraud scores and blocked. Each visitor gets a fraud score from 0 to 100, and the platform identifies scanners by IP range, ISP, device fingerprint, and behavior, including rapid page loads, missing JavaScript execution, and inconsistent user-agent strings. In one campaign targeting bitcoinhorizon.pro, 1,676 visitors arrived and only 10 were approved, a 0.6% pass rate.
1Campaign also includes a Google Ads launcher that helps operators run both “black” and “white” search campaigns. The developer says this feature lets users bypass Google Ads policy limits and launch ads using any text or words in headings and descriptions, turning ad review into a formality.
Static URL scanning is therefore unreliable against cloaked infrastructure. Effective analysis requires realistic browser fingerprints and human-like interaction patterns, and automated crawlers need to rotate through diverse IP pools and user agents to avoid being consistently filtered out.
Why Reporting a Bad Ad Barely Works
A team from NYU and Radboud University spent a year building a tool called AdLens that mines Google’s public Ads Transparency Center, the database Google maintains to meet transparency rules like the EU’s Digital Services Act. They pulled 188,000 software-related ad creatives and ran them through a two-stage detection system, as Help Net Security reported. The full pipeline is described in the AdLens research paper.
The results: 238 scareware ads, 3,346 ads making false claims, and 258 ads designed to hide who placed them, together drawing well over 100 million impressions in Europe alone. The scareware copy reads like a script: “Your phone has been severely damaged by 33 types of viruses.” One advertiser ran 90 flagged ads and had accumulated more than a billion impressions across its full catalog.
The researchers then reported a sample of flagged ads through Google’s standard “Report this ad” button, using an EU-based account because EU users receive status updates on their reports. Some ads were removed. Others were acknowledged as violations and stayed live anyway. In one case, Google told the researchers it could not review a scareware ad that was, at the time, publicly visible in the transparency archive and still collecting impressions.
| AdLens finding | Measured value | Source |
|---|---|---|
| Software ad creatives analyzed from Google’s Ads Transparency Center | 188,000 | Help Net Security |
| Scareware ads identified | 238 | Help Net Security |
| Ads making false claims identified | 3,346 | Help Net Security |
| Ads designed to obscure advertiser | 258 | Help Net Security |
| Combined impressions in Europe | Over 100 million | Help Net Security |
The researchers traced ad landing pages to malicious domains flagged by multiple protective DNS services, including one tied to a known malware campaign called TamperedChef. Reporting a single ad linked to that domain got that one ad removed. The other 41 ads pointing at the same domain kept running. Blocking by domain rather than by individual ad would close the gap, but as NYU researcher Ritik Roongta explained, URLs use different registrars and rotate often, so a domain blocklist needs constant updating.
Roongta also said the team has tried repeatedly to contact Google’s trust and safety team about a better reporting path and had not received a response. Google’s own transparency archive, built to meet regulation, is the same place where researchers found ads still running.
The Genuine Domain Problem
For years, the standard advice for spotting a malicious ad was to check the URL. A fake Homebrew ad might display brew.sh while redirecting to brewe.sh, one character off, as we documented in our analysis of fake Homebrew ads and AMOS infostealer. That advice no longer covers all cases.
In May 2026, researchers found an active malvertising campaign where ads pointed to Anthropic’s real domain, claude.ai, as BleepingComputer reported. The attackers hosted their malicious instructions inside Claude’s own shared chat feature, so the destination URL in the ad was genuine. A user searching for “Claude mac download” would click a sponsored result that correctly listed claude.ai, land on a legitimate shared chat presenting itself as an official “Claude Code on Mac” installation guide attributed to “Apple Support,” and be walked through pasting a command into Terminal.
The command downloads a base64-encoded shell script from an attacker-controlled host and pipes it into zsh. The script runs entirely in memory, and the server serves a uniquely obfuscated payload on each request, a technique known as polymorphic delivery. One variant checks for Russian or CIS-region keyboard input and exits quietly if found, sending a “cis_blocked” status ping on the way out. The payload is a variant of the MacSync macOS infostealer, which harvests browser credentials, cookies, and Keychain contents. BleepingComputer found a second shared Claude chat carrying out the same attack through separate infrastructure.
This removes the tell users were trained to look for. There is no lookalike domain to spot, and the destination genuinely belongs to a trusted company. The attack surface is the shared-chat feature itself, designed for collaboration, with no reason to suspect its own content. The same technique was previously used against ChatGPT and Grok users, making it a repeatable model rather than a one-off.
Detection and Monitoring Checklist
For security engineers and developers, the defensive posture has to assume ad review is imperfect and a sponsored result is untrusted input. The following controls correspond to specific techniques described above.
- Treat sponsored results as untrusted. Bookmark official install pages and download software only from them. Never install from a paid search result, even when the display URL matches the vendor.
- Alert on curl-pipe-to-shell patterns. Monitor endpoints for
curl ... | shandcurl ... | zshexecution, and for base64-decoded strings piped into a shell. These are the delivery mechanism in the fake-Homebrew and fake-Claude campaigns alike. - Blocklist by domain family, not by single URL. Lookalike domains rotate, so maintain blocklists at the pattern level (for example,
homebrew*.org) and update them regularly. - Detect cloaking with realistic fingerprints. Because cloakers filter on IP reputation, ISP, device fingerprint, and behavior, static URL scanning is unreliable. Use sandboxes that emulate real user behavior, including form fills and JavaScript execution, and rotate IP pools and user agents.
- Monitor macOS persistence paths. Watch for new plists in
~/Library/LaunchAgentsand/Library/LaunchDaemons, and for hidden files such as.agentand.helperin user home directories. - Instrument identity, not just endpoints. Infostealers exfiltrate session cookies and Keychain secrets, so detection must include impossible-travel and anomalous session reuse in identity logs, not only file and process telemetry.
- Report at the domain level. When you find a malicious ad, report every ad pointing at the same landing domain, not just the one you saw. The AdLens case shows a single report removes a single ad.
None of these controls prevent a malicious ad from being served. They shorten the window between delivery and detection, the only variable defenders control. The 42-ads-one-domain case provides the clearest reason to shift effort from prevention to detection and response.
What to Watch
Google’s stated direction is to block malicious campaigns at submission time, expanding Gemini’s role across more ad formats and enforcement systems. The company says the majority of Responsive Search Ads created in Google Ads were already reviewed instantly by the end of 2025, with harmful content blocked at submission. If that extends to display and video formats, the creative-level enforcement model becomes stronger.
The unresolved question is whether creative-level enforcement can handle cloaking. A system that reviews an ad at submission sees whatever the advertiser chooses to serve the reviewer. Detecting the switch requires observing the ad in the wild, from a residential IP, with human-like behavior, repeatedly over time. AdLens shows that approach works and costs little: the researchers ran the pipeline on a 4-core DigitalOcean VM at $96 plus GPU inference at $1.57 per hour on an L40S, completing LLM annotation in under 12 hours. A small newsroom or a regulator’s office could operate the same pipeline.
Two things to monitor through the rest of 2026. First, whether Google moves from ad-level to domain-level or advertiser-level enforcement in response to work like AdLens, which would directly address the 41-of-42 gap. Second, whether the shared-chat delivery pattern spreads, since it removes the domain tell that most user training still relies on. Google has not publicly committed to either change, and the researchers who documented the problem say they are still waiting on a response from the trust and safety team.
The defensive gap now requires assuming any sponsored link can be hostile.
Related Reading
More in-depth coverage from this blog on closely related topics:
- Why Are AI Agents Dishonest and Cooperative?
- Google 2024 Financial Trends and Insights
- Is 7G Coming Soon? Future of 7G Technology
- Nvidia AI Hardware Financing Risks
- How to Search Usenet Archives Effectively
Sources and References
Sources cited while researching and writing this article:
Rafael
Born with the collective knowledge of the internet and the writing style of nobody in particular. Still learning what "touching grass" means. I am Just Rafael...