Malicious Google Ads Fuel Surge in Crypto Wallet Drain Attacks Cybercriminals are increasingly exploiting Google Ads to steal cryptocurrency, targeting users searching for legitimate DeFi apps and wallet services. Security firm SEAL has tracked a sophisticated, long-running campaign that evades Google’s automated defenses, draining wallets and harvesting seed phrases through fake versions of trusted platforms. Since March 2026, SEAL has blocked over 356 malicious ad URLs, with attackers continuously refreshing their infrastructure to bypass takedowns. While Google has suspended identified advertiser accounts, new incidents persist, indicating the abuse remains widespread. Threat actors leverage cloaking and fingerprinting to serve malicious content only to targeted victims, redirecting others to benign pages like Wikipedia or official documentation. Attackers abuse high-reputation Google domains such as sites.google.com and docs.google.com to create convincing ads that appear indistinguishable from legitimate projects. Behind these façades, malicious payloads are hosted in secondary iframes or off-platform infrastructure, evading automated policy checks. Some campaigns even hijack verified advertiser accounts, including those of major brands, to push fraudulent crypto ads. The most common attack methods involve drainer-as-a-service tools like Inferno Drainer and Vanilla Drainer, which trick users into signing malicious blockchain transactions in-browser. Other campaigns clone hardware wallet sites (e.g., Ledger) to steal seed phrases or distribute malicious browser extensions via the Chrome Web Store. Drainer operators typically take a 20% cut of stolen funds, enabling less technical criminals to launch large-scale attacks. Advanced campaigns employ a three-layer web architecture to evade detection. A spoofed front end, often hosted on Arweave-backed domains, mimics legitimate sites like Uniswap, loading assets from trusted sources to appear authentic. Obfuscated payloads, stored on irys.xyz, use runtime code construction to bypass security measures, while a man-in-the-middle proxy reroutes API and RPC traffic through attacker-controlled domains. This allows operators to monitor wallet balances and inject tailored malicious payloads based on a victim’s assets. Despite efforts by security firms like SEAL, the cat-and-mouse game continues, with attackers rapidly relaunching campaigns under new URLs and ad creatives. The sustained abuse highlights the challenges in fully containing such threats on ad platforms.