Skip to main content

Is your browser mining bitcoin? ‘Malvertisements’ are hijacking Google Ads

google ads cryptocurrency malware hong kong lifestyle bitcoin
Philippe Lopez/AFP/Getty Images
As if invasive ads weren’t bad enough, Trend Micro uncovered a particularly sinister batch of ‘malvertisements’ that aim to exploit Google’s DoubleClick ad service to serve you ads containing hidden cryptocurrency mining software.

“Attackers abused Google’s DoubleClick, which develops and provides internet ad serving services, for traffic distribution. Data from the Trend Micro Smart Protection Network shows affected countries include Japan, France, Taiwan, Italy, and Spain. We have already disclosed our findings to Google,” Trend Micro reports.

As malware goes, it’s actually pretty clever — if also sinister and awful. It operates two separate scripts, one a coinhive cryptocurrency miner, the other a private web miner. Which one it will use is determined by a random number generator. When either one kicks in, it would use 80 percent of the affected computer’s CPU resources for the purposes of mining cryptocurrency.

“The affected webpage will show the legitimate advertisement while the two web miners covertly perform their task. We speculate that the attackers’ use of these advertisements on legitimate websites is a ploy to target a larger number of users, in comparison to only that of compromised devices,” Trend Micro reports.

Trend Micro goes on to report that the number of incidents of these malvertisements has gone down since January 24, so we might be in the clear. Still, it might be a good idea to make sure your security apps are all up to date — and make sure your browser has its latest security patches. Chances are Google will get the exploit under control quickly, but there are some countermeasures you can implement in the meantime.

“Blocking JavaScript-based applications from running on browsers can prevent coinhive miners from using CPU resources. Regularly patching and updating software — especially web browsers –can mitigate the impact of cryptocurrency malware and other threats that exploit system vulnerabilities,” Trend Micro recommends.

All right, so how can you protect yourselves from this exploit while Google gets it sorted out? Turns out there are a couple things you can do. First, make sure your browser is up to date. You can do that by heading to your preferences and checking for updates in most modern browsers like Chrome and Firefox. Second, run an adblocker on any site that you feel a little uncomfortable about. Lastly, you can always disable JavaScript entirely, but doing so will break a lot of websites and it’s only a good idea if you’re very worried about your security.

Jayce Wagner
Former Digital Trends Contributor
A staff writer for the Computing section, Jayce covers a little bit of everything -- hardware, gaming, and occasionally VR.
Get paid in cryptocurrency for viewing ads in the new Brave browser
earn cryptocurrency in brave browser blocks google

Brave Software officially launched version 1.0 of its Brave web browser on Wednesday, November 13. The first version launched in January 2016 and has since gained more than 2.8 million active users daily and eight million active users monthly. It’s based on Google’s Chromium browser and relies on Basic Attention Tokens (BAT) to generate revenue.

The idea behind Brave’s BAT system is to reward content creators using cryptocurrency. It doesn’t generate virtual coins in the background, but rather provides means for readers to tip 300,000 participating Brave Certified Publishers. These include The Washington Post, The Guardian, MarketWatch, and more.

Read more
A dangerous new jailbreak for AI chatbots was just discovered
the side of a Microsoft building

Microsoft has released more details about a troubling new generative AI jailbreak technique it has discovered, called "Skeleton Key." Using this prompt injection method, malicious users can effectively bypass a chatbot's safety guardrails, the security features that keeps ChatGPT from going full Taye.

Skeleton Key is an example of a prompt injection or prompt engineering attack. It's a multi-turn strategy designed to essentially convince an AI model to ignore its ingrained safety guardrails, "[causing] the system to violate its operators’ policies, make decisions unduly influenced by a user, or execute malicious instructions," Mark Russinovich, CTO of Microsoft Azure, wrote in the announcement.

Read more