Malvertising has been an effective way to lure users into downloading malware for many years, but this new example of a malicious usage of Google Ads seems to be a more powerful and sophisticated tactic to acquire widespread shell deployment, since it enables cybercriminals to directly target specific companies and their – Extremely high CPU as well as GPU usageīesides CPU usage, some of the coin miners additionally use GPU power for their operations.

Google has been contacted in regard to the discovery and has reportedly taken immediate steps to draw the malicious ads down. Researchers explain that the malicious AnyDesk installer is served to unsuspecting Google users who are searching for “AnyDesk” through the search engine with the help of malicious ads placed by the criminal actors in the search results.Īs soon as the users click on the malicious ads in the search results, they are redirected to a specially crafted page that looks exactly as the AnyDesk official website.

As per details on AnyDesk’s website, its remote desktop software solution has more than 300 million users from all over the globe, which is a large user base to target. Based on the available details, professionals are assuming that this is a widespread campaign that is aimed at a wide range of customers. Once downloaded and executed, however, this file downloads a PowerShell implant that can be used for collecting and exfiltrating different types of data from the compromised system.Īs of the time of this writing, the malvertising attack targeting AnyDesk has not been linked to any specific malicious actor. The malware distributing campaign is believed to have started on 21st of April 2021, and consists of a malicious file pretending to be an AnyDesk (AnyDeskSetup.exe) executable.

Any desk exe file download