Threat actor impersonates Google

A recent article, also part of this week’s Malware Bytes talks about Google getting bitten.

The Google Authenticator is well known authentication application, and someone registered a .fun domain to fascilitate the malicious program as well as a couple of misspelled domains in the .com registry.

While Malwarebytes says not to necessarily use the add, I would say that you can probably look to see where it goes with our guide on how to check links.

Although those links may be lengthy, you can now see in some browsers copy links without site tracking, use that and paste the link in a note editor for review.

This will show you the exact URL without going through Google’s redirection chain which they use to track who clicks.

Threat actor impersonates Google via fake ad for Authenticator has the entire story including the domain list, what’s being tracked, and what to look for.