What you need to know

• Fraud is designed to harvest Adsense views and clicks and promote dodgy crypto schemes
• Uses redirects from Google, Twitter and Bing to create an air of legitimacy
• First detected last year but big surge in recent weeks

An new ad fraud scheme targeting Wordpress sites hosting Google Adsense ads has surged in recent weeks. First detected by security firm Sucuri in late 2022, the attack has now infected almost 11,000 sites around the world.

This particular scheme uses redirects from Google, Bing and Twitter to create an air of authenticity.

Ad fraud remains a huge and still growing problem in the digital marketing ecosystem. The World Federation of Advertisers famously suggested that ad fraud would  overtake the illicit drugs racket by 2025 as the scale of the problem grew to $US50bn. It turns out rgw WFA might have been too conservative - Juniper Research estimated that ad fraud was worth $68bn in 2022.

Five countries - the US, Japan, China, South Korea and the UK - account for 60 per cent of the losses, according to Juniper.

While it doesn’t appear in the leaderboard, Australia is not immune. In 2021, for instance, Mi-3 reported that Australia was the desktop video ad fraud capital of the world. More recently the first industrial scale ad fraud scheme hit the digital audio sector.

Motivations
The goal of the fraudsters in the scheme, described by Sucuri, seems to be two-fold: Firstly to promote a couple of dodgy crypto currency schemes but also to increase the traffic to web pages created by the fraudsters that host Google Adsense ads.

According to Sucuri’s ananlyst and researcher Ben Martin, “unwanted redirects via fake, short URLs to fake Q&A [Question and  Answer] sites result in inflated ad views/clicks and therefore inflated revenue for whomever is behind this campaign. It is one very large and ongoing campaign of organised advertising revenue fraud.”

Sucuri found that fraudsters were using legitimate services from Cloudflare, a company that provides a service to help make websites faster, more secure and reliable and which also provides security features to help protect the website from malicious traffic and attacks, such as DDoS (Distributed Denial of Service) attacks.

After being booted from Cloudflare, the fraudsters shifted to DDoSGuard, which Martin describes as “a controversial Russian DDOS service that operates as a Belize corporation".

In a company blog about the fraud, Martin: “We strongly encourage website owners to patch all software to the latest version to mitigate risk and secure wp-admin panels with 2FA or other access restrictions.” Companies that have already been infected were advised to “change all access point passwords, including admin credentials, FTP accounts, cPanel, and hosting.”
The company also provided a step-by-step guide to cleaning websites that have been hit.