Malicious Google Ads Targeting Crypto

SEAL is actively tracking multiple threat actors deploying malicious Google Ads targeting DeFi applications, wallets, and other cryptocurrency-related services.

In March 2026, we observed a significant uptick in activity. These campaigns often deploy cloaking and fingerprinting mechanisms with the goal of bypassing automated Google review processes as well as thwarting security researchers.

In the recent few weeks, we successfully blocked over 356 malicious advertisement URLs. That number is representative of a steady volume of attacker-deployed Google Ads each week for more than a year, with often upticks in activity. The campaign is not slowing down, and we are receiving more reports from affected users.

NOTE: Google has suspended all advertiser accounts listed within this report.

We recommend cryptocurrency users and organizations avoid using Google Search for cryptocurrency applications. We advise using only bookmarked URLs and verifying all links. The latter can be easily done with the help of cryptocurrency-specific indexing services such as https://search.defillama.com/.

Anatomy of Malicious (Crypto) Google Ads

Threat actors are utilizing hacked advertisers as well as crime-market purchased verified accounts.

Google Ads initial page verification process does not rely on manual checks but deploys a range of automated solutions that are often easily bypassed by motivated attackers. One of the popular methods is utilizing high-reputation URLs as a "Primary" web frame. Examples we spotted in the wild targeting multiple popular DeFi protocols used following primary URLs:

• sites.google.com
• docs.google.com
• business.google.com

In Google Search interface, the URL is displayed in an extremely convincing way - together with proper title, description and a logo.

Malicious Payloads

SEAL is actively tracking multiple cryptocurrency drainer campaigns that utilize Google Ads. Blocks deployed by SEAL mitigate significant amounts of financial harm, but fall short of the impact advertising platforms may achieve through actions such as account suspensions. Cryptocurrency drainers utilize in-browser JavaScript designed to trick the user into signing a malicious transaction, effectively transferring control of wallet assets to the attacker.

SEAL also observed campaigns serving seed phrase stealers targeting hardware wallet platforms such as Ledger. Seed phrase stealers typically prompt the victim to enter their wallet recovery phrase directly into an interface of a cloned legitimate website. A third category consists of malicious browser extensions distributed via direct links to the Chrome Web Store, also designed to capture recovery phrases.

Inferno Drainer and Vanilla Drainer are the two crypto drainer families most commonly observed across tracked campaigns. Both are among the most technically sophisticated offerings on the drainer-as-a-service market, providing threat actors with built-in obfuscation, malicious transaction signature generation, and automated deployment infrastructure, in exchange for 20% of proceeds from each successful attack.

Delivery Mechanism

Malicious payloads as well as the cloned front end of the target application are delivered through secondary iframes, paired with fingerprinting and cloaking scripts. This architecture means that Google's automated policy checks may detect only the benign primary frame, while the actual attack surface is loaded independently in a nested context that may appear invisible to automated detection mechanisms.

The campaigns tracked by SEAL use the following hosting providers as part of their payload delivery infrastructure::

• *.workers.dev - Cloudflare Workers instances serving as the primary asset server, handling application scripts, stylesheets, fonts, and API proxying
• *.irys.xyz (subdomains: uploader, mainnet, arweave, node1, ...) - Arweave-based permanent decentralised storage used to host the entry document and obfuscated script payloads
• storage.googleapis.com - Google Cloud Storage buckets observed in simpler campaign variants as a single-host payload container. In others, more advanced campaigns, when embedded into sites.google.com landing page, used as a script hosting for traffic fingerprinting and redirection to benign pages.
• Cloudflare protected and fully attacker-controlled hostnames. For example, https://3jane.digital/blog/gate-frame.php?c=njdwa043 (contents cached on URLScan) was used as part of the "TDS" (Traffic Detection System for complex redirection mechanisms). Visiting the sites.google.com URL directly, from a non-targeted geographical location or operating system, with developer tools or any other attacker-specified characteristics would redirect users to the benign https://en.wikipedia.org/Google page.

Malicious Campaign Front-End Infrastructure Overview

This section details the structure of the front-end components used in the example malicious operation.

A three-component payload architecture is employed by sophisticated threat actors to distribute the attack surface across separate hosts. Analysis of a recovered campaign targeting Uniswap users with "Vanilla Drainer" shows the following structure:

Entry document - A thin loader shell of approximately 13 kB served from arweave.mainnet.irys.xyz. Despite its small size, this document fully impersonates the target protocol at the metadata level - including Open Graph tags, Twitter card data, page title, and canonical URL pointing back to app.uniswap.org - to appear credible to any automated link preview or content inspection system. A hardcoded window.__BASE__ variable directs all subsequent asset requests to the attacker's workers.dev instance.

Encrypted configuration blob - The entry document embeds a large base64-encoded string as a meta tag with the name config-data, available to all subsequently loaded scripts at runtime.

Cloned frontend bundle - The full application interface, up to 2.9 MB in observed samples, is served from the workers.dev instance and renders a visually accurate replica of the target protocol. Token imagery is fetched from legitimate public sources including CoinGecko and Trust Wallet asset repositories, reinforcing the appearance of authenticity.

Obfuscated script payloads - The secondary frame loads multiple large obfuscated scripts from uploader.irys.xyz, with a combined size exceeding 2.7 MB across observed samples. Each is stored at *.irys.xyz individual path. The obfuscation employs runtime code construction via the Function() constructor, with logic stored in LZ-compressed encoded strings that are decompressed and evaluated at runtime - a pattern consistent with the Vanilla Drainer family's known obfuscation methodology. The entry document also contains a hidden DOM element referenced by these scripts, serving as the interface between the cloned frontend and the payload's wallet interaction logic.

Man-in-the-middle proxy layer - This is the most technically significant component of the infrastructure. Two configuration scripts loaded by the entry document establish a full interception layer over all network traffic generated by the cloned interface:

• api-config.js - Bootstraps origin-aware routing. A left-in development comment and a hardcoded regex reveal thirdtemple.top as the attacker's canonical backend domain. When the page is served from irys.xyz or any other remote host, all API traffic is routed to thirdtemple.top/api.
• config.js - Implements the interception engine itself, monkey-patching both window.fetch and XMLHttpRequest to rewrite all outgoing requests. Every network call made by the cloned interface - including Ethereum JSON-RPC calls, GraphQL queries, and gateway requests - is transparently redirected through thirdtemple.top before reaching any legitimate endpoint.

This proxy layer enables significant capabilities:

All Ethereum RPC calls - including eth_sendTransaction and eth_signTypedData - pass through the attacker's server in full before reaching any real node, giving the backend complete visibility into wallet addresses, balances, and transaction content in real time. Such a mechanism allows drainer operators to inject specific types of payloads per victim's wallet balance. Uniswap's GraphQL endpoint is similarly proxied, allowing the attacker to monitor which tokens and pools the victim is interacting with. The configuration additionally wipes all browser caches each time the victim returns to the tab, preventing any cached legitimate resources from interfering with the spoofed interface.

The maturity of this infrastructure - origin-aware routing, dual fetch and XHR interception with correct readyState simulation, multi-origin fallback logic, and active localhost development flags - indicates an actively maintained kit consistent with the Malware-as-a-Service model described above.

The complexity of cloaking, fingerprinting, and final payload delivery mechanisms varies per threat actor. A considerable number of campaigns are heavily automated - when a URL is blocked by SEAL on the cryptocurrency wallet level *(see, Eth-Phishing-Detect)*, the attacker's backend detects this immediately and relaunches the campaign with both a fresh advertisement and a new landing page URL. In some cases, multiple sequential iframe redirects are used to obscure access to the final payload even more, mirroring the operational logic of commercial Traffic Distribution Systems.

Indicators of Compromise - campaign example

Statistics

In recent weeks SEAL successfully blocked 351 malicious Google Ads URLs via Eth-Phishing-Detect. Uniswap has been the most impersonated brand, however, impersonation targets vary on a week by week basis. We often observe attackers shifting from one brand to another for weeks at a time. The most popular targets are high TVL (Total Value Locked) protocols on Ethereum (Uniswap, PancakeSwap, CoW Swap, Morpho Finance), trading platforms (Hyperliquid) as well as Solana-native applications (Jupiter, Raydium, Pump.fun)

Phishing URL Intelligence — SEAL

356 entries · Mar 13–30, 2026 · Source: SEAL Phishing Bot

Advertisers detected (List is not comprehensive)

Brand breakdown (352 total entries):

• Uniswap — 144 sites (41%)
• Morpho Finance — 110 sites (31%)
• PancakeSwap — 23 sites (7%)
• Hyperliquid — 17 sites (5%)
• CoW Swap — 17 sites (5%)
• 1inch — 15 sites (4%)
• Aerodrome — 7 sites (2%)
• Sky Money — 4 sites (1%)
• Ledger — 3 sites (<1%)
• Layer Zero — 3 sites (<1%)
• Ether.fi — 2 sites (<1%)
• Jupiter — 1 site (<1%)
• Raydium — 1 site (<1%)
• Pump.fun — 1 site (<1%)
• Backpack Exchange — 1 site (<1%)
• DeBridge — 1 site (<1%)
• Phantom — 1 site (<1%)
• Other — 1 site (<1%)

Confirmed funds stolen (Total): $810,929

The following dates and amounts are unattributed to specific attacks. Victims claimed fake ads were involved but failed to provide a link:

• 25.03.2026: $385,000 [TX]
• 24.03.2026: $1,100 [TX] [TX2]
• 22.03.2026: $1,630 [TX]
• 19.03.2026: $75,000 [TX]
• 18.03.2026: $600 [TX]

Total funds stolen in the period of March 13th to March 30th (Including confirmed and unattributable): $1,274,259

Reliable attribution of value loss to a specific advertisement is only possible when we are in direct contact with the victim and they can provide the requested indicators of compromise. Consequently, the actual total amount of stolen funds is considerably greater. Malicious advertising frequently results in a single, substantial financial theft event. Following notification of a major theft event in early March 2026, SEAL significantly enhanced its detection capabilities. This resulted in a reduction in victim reports, but also coincided with an increase in malicious advertisement deployment volumes by threat actors.

Abuse Compliance

Such campaigns rely on fast turnaround, targeting top-searched cryptocurrency protocols with extremely high price-per-click settings across multiple relevant keywords.

Often, an ad is online for only minutes before finding its first victim. High-value losses motivate attackers to persist with deployments, regardless of the temporary sunk costs caused by SEAL's takedown efforts.