Hackers Exploit Google Ads in AiTM Phishing Attack Targeting GoDaddy ManageWP Users Cybercriminals are leveraging Google Ads to steal credentials for GoDaddy’s ManageWP, a widely used WordPress management platform, through an adversary-in-the-middle (AiTM) phishing campaign. Researchers at Guardio Labs uncovered the operation, which tricks users searching for "ManageWP" by placing a malicious sponsored ad above the legitimate result. When victims click the fake ad, they are redirected to a cloned ManageWP login page that closely mimics the real interface. Unlike traditional phishing, this attack employs a live proxy that relays credentials in real time to the authentic ManageWP service, logging the attacker in simultaneously. Stolen credentials are also forwarded to a Telegram channel controlled by the threat actors. The scheme bypasses two-factor authentication (2FA) by presenting a fake 2FA prompt, allowing attackers to intercept one-time codes and gain full access to compromised accounts. Once inside, they can control connected WordPress sites, deploy malicious plugins, exfiltrate data, or escalate access to hosting environments. Guardio Labs infiltrated the attackers’ infrastructure, discovering a custom operator-driven panel that dynamically manages phishing sessions. The framework appears to be a private tool, not a commercial phishing-as-a-service kit, with code artifacts suggesting Russian origins including a disclaimer prohibiting use against Russian targets. The campaign has already claimed at least 200 victims, though the true number may be higher given ManageWP’s 1 million+ installations. The attack underscores the growing threat of malvertising, where cybercriminals exploit paid search slots to distribute phishing and malware at scale. Users are advised to avoid searching for login pages and instead bookmark official URLs to mitigate risk.