The cyber‑crime community has uncovered a new tool called 1Campaign that allows attackers to launch malicious Google ads and keep them running for months without detection by security researchers or automated scanners.
This cloaking service passes Google’s automated screening process and serves benign white pages to bots, while showing phishing and crypto‑drainer content only to real potential victims. The platform is operated by a developer who uses the pseudonym “DuppyMeister” according to data‑security firm Varonis. 1Campaign has been active for at least three years.
A key feature of 1Campaign is its real‑time visitor filtering. It can redirect traffic to specific landing pages based on geographic location, ISP, device characteristics, and other criteria. In one observation, the system blocked 99.4 % of visitors from a sample set of 1,676 users, leaving only about ten genuine victims.
The platform assigns each visitor a fraud risk score between 0 and 100 by evaluating infrastructure details such as cloud providers, VPNs, and security vendors. Visitors coming from major cloud services—Microsoft, Google, Tencent Cloud, OVH Hosting, among others—receive high fraud scores and are automatically blocked.
Varonis reports that traffic associated with 1Campaign originates from the United States, Canada, the Netherlands, China, Germany, France, Japan, Hungary, and Albania. The tool also includes a Google Ads launcher that helps operators bypass Google’s policy limitations and impersonate legitimate brands in ads.
Despite Google’s numerous safeguards, its ad platform remains vulnerable to fraud, malware, and crypto‑drainer campaigns. 1Campaign stands out because it is specifically designed to launch malicious ads that pass automated inspection and can survive until victims report them or the campaign is manually flagged.
The cloaking system makes static URL scanning ineffective; realistic browser fingerprints and human‑like interaction patterns are required for better detection. Varonis recommends rotating IP pools and user‑agent configurations to avoid consistent fingerprinting.
Users should remain cautious of promoted search results, double‑check URLs before entering sensitive information, and prefer official distribution channels when accessing software or services.
}}
