{"id":46352,"date":"2022-04-25T14:49:46","date_gmt":"2022-04-25T14:49:46","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33365\/Hackers-Use-Malicious-Google-Ads-To-Steal-4-Million-In-Stablecoin.html"},"modified":"2022-04-25T14:49:46","modified_gmt":"2022-04-25T14:49:46","slug":"hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/","title":{"rendered":"Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin"},"content":{"rendered":"<p><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"28\"><\/p>\n<p>Hackers used malicious Google ads to trick users into giving up their private key to steal their cryptocurrency.&nbsp;<\/p>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"36.242748091603\"><\/p>\n<p>The cybercriminals targeted people who hold UST, a popular cryptocurrency that aims to remain pegged to the U.S. dollar from the Terra blockchain\u2014<a href=\"https:\/\/www.vice.com\/en\/article\/g5q93b\/stablecoins-are-in-a-war-for-dominance-and-its-getting-ugly\">a so-called stablecoin<\/a> currently vying for dominance in decentralized finance, or DeFi. The phishing operation was spotted by cybersecurity firms <a href=\"https:\/\/twitter.com\/KS_Blockchain\/status\/1517481543845179393\" target=\"_blank\" rel=\"noopener\">Knownsec Blockchain Labs<\/a> and <a href=\"https:\/\/twitter.com\/SlowMist_Team\/status\/1516961806509563904\" target=\"_blank\" rel=\"noopener\">SlowMist<\/a>. According to Knownsec, the hackers have stolen $4.31 million from 52 wallets, which they hacked between April 12 and April 21. Knownsec <a href=\"https:\/\/finder.terra.money\/mainnet\/address\/terra1fz57nt6t3nnxel6q77wsmxxdesn7rgy0h27x30\" target=\"_blank\" rel=\"noopener\">posted a Terra address<\/a> that the company says is linked to the hack, which contains 4,111,901 UST tokens ($4,111,901) and 2,089 LUNA tokens\u2014part of the Terra ecosystem\u2014worth $197,269.<\/p>\n<p><\/span><span><\/p>\n<div class=\"adph adph--border\">\n<p>Advertisement<\/p>\n<\/div>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"33\"><\/p>\n<p>Motherboard confirmed that a malicious ad targeting Terra users is the first result when searching &#8220;Terra bridge&#8221; on Google. The URL on the ad appears to match the real Terra bridge URL, which is bridge.terra.money. But once one clicks on it, instead of going to bridge.terra.money, the user is redirected to bridge.terra.momey.biz.&nbsp;<\/p>\n<p><\/span><\/p>\n<div class=\"body-image\" data-component=\"ImageBlock\">\n<div class=\"body-image__img\">\n<div><picture class=\"responsive-image lazyloader--lazy lazyloader--lowres\"><source media=\"(min-width: 1000px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640632412-image2.png?resize=20:*\"><source media=\"(min-width: 700px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640632412-image2.png?resize=20:*\"><source media=\"(min-width: 0px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640632412-image2.png?resize=20:*\"><img class=\"responsive-image__img\" alt=\"image2.png\"><\/picture><\/div>\n<\/div>\n<\/div>\n<div class=\"body-image\" data-component=\"ImageBlock\">\n<div class=\"body-image__img\">\n<div><picture class=\"responsive-image lazyloader--lazy lazyloader--lowres\"><source media=\"(min-width: 1000px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640876240-screen-shot-2022-04-22-at-101247-am.png?resize=20:*\"><source media=\"(min-width: 700px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640876240-screen-shot-2022-04-22-at-101247-am.png?resize=20:*\"><source media=\"(min-width: 0px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640876240-screen-shot-2022-04-22-at-101247-am.png?resize=20:*\"><img class=\"responsive-image__img\" alt=\"Screen Shot 2022-04-22 at 10.12.47 AM.png\"><\/picture><\/div>\n<\/div>\n<\/div>\n<p><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"29\"><\/p>\n<p>That site is currently flagged as \u201cdeceptive\u201d by Google and closely resembles the real Terra bridge website, and immediately presents the user with a pop-up asking them to connect their wallet.<\/p>\n<p><\/span><\/p>\n<div class=\"body-image\" data-component=\"ImageBlock\" readability=\"31\">\n<div class=\"body-image__img\">\n<div><picture class=\"responsive-image lazyloader--lazy lazyloader--lowres\"><source media=\"(min-width: 1000px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640679455-image4.png?resize=20:*\"><source media=\"(min-width: 700px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640679455-image4.png?resize=20:*\"><source media=\"(min-width: 0px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640679455-image4.png?resize=20:*\"><img class=\"responsive-image__img\" alt=\"image4.png\"><\/picture><\/div>\n<\/div>\n<div class=\"body-image__caption\" readability=\"32\">\n<p>A screenshot of the phishing site. (Image: Motherboard)<\/p>\n<\/div>\n<\/div>\n<div class=\"body-image\" data-component=\"ImageBlock\" readability=\"31\">\n<div class=\"body-image__img\">\n<div><picture class=\"responsive-image lazyloader--lazy lazyloader--lowres\"><source media=\"(min-width: 1000px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640700814-image1.png?resize=20:*\"><source media=\"(min-width: 700px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640700814-image1.png?resize=20:*\"><source media=\"(min-width: 0px)\" srcset=\"https:\/\/video-images.vice.com\/_uncategorized\/1650640700814-image1.png?resize=20:*\"><img class=\"responsive-image__img\" alt=\"image1.png\"><\/picture><\/div>\n<\/div>\n<div class=\"body-image__caption\" readability=\"32\">\n<p>A screenshot of the real Terra site. (Image: Motherboard)<\/p>\n<\/div>\n<\/div>\n<p><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"31\"><\/p>\n<p>A moderator of Terra\u2019s official Discord channel, who goes by &#8220;Somethingelse,&#8221; told Motherboard that he spotted the malicious ads targeting the bridge and reported them to Google. Several people in the Discord channel also warned others of the malicious Google ads.&nbsp;<\/p>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"27.3046875\"><\/p>\n<p>According to Somethingelse, malicious ads targeting various aspects of the Terra\/Luna ecosystem have plagued investors for months. Another Terra moderator <a href=\"https:\/\/twitter.com\/xLiquidSpirit\/status\/1502733589657501698?s=20&amp;t=ld9Wka3qBo423EC3QFmTOw\" target=\"_blank\" rel=\"noopener\">warned users on Twitter<\/a> in March about ads targeting investors seeking the Anchor lending protocol.&nbsp;<\/p>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"34\"><\/p>\n<p>\u201cFor the past few months, Anchor Discord saw a large uptick in users claiming that funds were stolen from their addresses. As the mod team worked with these folks, we started seeing a pattern of users saying they used Google to go to Anchor. After having the users show us their browser history, we could see where they went to a scam site. I can show you an example,\u201d Somethingelse said in an online chat.<\/p>\n<p><\/span><span><\/p>\n<div class=\"adph adph--border\">\n<p>Advertisement<\/p>\n<\/div>\n<p><\/span><\/p>\n<blockquote data-component=\"QuoteBlock\" class=\"abc__quote abc__quote--blockquote\" readability=\"8.3769230769231\">\n<p><em><strong>Do you have more information this phishing campaign? Or other web3 and crypto hacks? We\u2019d love to hear from you. You can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, Wickr\/Telegram\/Wire @lorenzofb, or email&nbsp;<a href=\"mailto:lorenzofb@vice.com\">lorenzofb@vice.com<\/a><\/strong><\/em><\/p>\n<\/blockquote>\n<p><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"37\"><\/p>\n<p>\u201cSeveral weeks ago we saw an uptick&nbsp;in user feedback across our community channels detailing typosquatting\/phishing scams on Google Search, alongside scam ads mimicking the websites of products like Terra Station, the primary wallet for interacting on the Terra network, and others like Anchor protocol, a savings protocol and money market on Terra,\u201d a spokesperson for Terraform Labs (TFL), the company behing the Terra blockchain and the UST stablecoin, said in an email.<\/p>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"35\"><\/p>\n<p>\u201cThe strategy deployed by the scammers is evolving but mostly includes purchasing fake ads via Google or directing users to copycat websites (i.e., Station, Anchor, etc.) with a similar URL to the actual products&#8217; domain, asking users to connect their wallets and deposit funds, which are then absconded with by the scammers. Other methods include typosquatting sites for Station that prompt users to input their seed phrase to steal their funds.\u201d the spokesperson added.<\/p>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"29\"><\/p>\n<p>These phishing attacks show how hackers are getting creative in targeting people who hold cryptocurrency. They also show it\u2019s possible to steal millions in crypto even without hacking the crypto company or project directly.<\/p>\n<p><\/span><span><\/p>\n<div class=\"adph adph--border\">\n<p>Advertisement<\/p>\n<\/div>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"20.196428571429\"><\/p>\n<p>In the last few months, hackers have targeted large crypto companies like the play-to-earn video games <a href=\"https:\/\/www.vice.com\/en\/article\/3abeeb\/hackers-steal-dollar600m-from-play-to-earn-game-axie-infinitys-ronin-network\">Axie Infinity<\/a> and <a href=\"https:\/\/www.vice.com\/en\/article\/3abwj3\/play-to-earn-game-token-collapses-after-hacker-cashes-out\">WonderHero<\/a>, the stablecoin <a href=\"https:\/\/www.vice.com\/en\/article\/4awe53\/we-are-fucked-crypto-stablecoin-collapses-after-dollar182m-hack\">Beanstalk<\/a>, the Poly Network, the <a href=\"https:\/\/www.vice.com\/en\/article\/xgd483\/dollar320-million-crypto-heist-rocks-decentralized-finance-world\">cross-chain bridge Wormhole<\/a>, the<a href=\"https:\/\/www.vice.com\/en_us\/article\/g5qj9j\/cryptocom-says-incident-was-actually-dollar30-million-hack\"> popular exchange Crypto.com<\/a>, <a href=\"https:\/\/www.vice.com\/en\/article\/v7dzd8\/people-are-still-getting-pwned-a-week-after-a-crypto-hack-was-contained\">Multichain<\/a>, the <a href=\"https:\/\/www.vice.com\/en\/article\/4awxep\/hackers-steal-dollar140-million-from-users-of-crypto-gaming-company\">crypto gaming company Vulcan Forge<\/a>, <a href=\"https:\/\/www.vice.com\/en\/article\/v7dv4a\/hacked-cryptocurrency-platform-begs-hacker-to-please-return-dollar119-million\">BadgerDAO<\/a>, and<a href=\"https:\/\/www.vice.com\/en\/article\/akvewk\/hackers-steal-dollar150m-from-crypto-exchange-billed-as-most-trusted\"> crypto exchange BitMart<\/a>.&nbsp;<\/p>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"30.362467866324\"><\/p>\n<p>A Google spokesperson sent the following statement via email: \u201cProtecting users from ad scams and fraud is a key priority, and we have strict <a href=\"https:\/\/support.google.com\/adspolicy\/answer\/6020955?hl=en\" target=\"_blank\" rel=\"noopener\">policies<\/a> that specifically prohibit phishing ads. We&#8217;ve reviewed the advertiser accounts in question and have taken appropriate enforcement action. We will continue to aggressively enforce our policies to prevent future abuse from bad actors.\u201d<\/p>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"30\"><\/p>\n<p><strong>UPDATE, Apr. 22, 4:11 p.m. ET<\/strong>: This story has been updated to include a comment from Terraform Labs.<\/p>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"29\"><\/p>\n<p><strong>UPDATE, Apr. 25, 10:41 a.m. ET: <\/strong>This story was update to include Google\u2019s comment. <\/p>\n<p><\/span><span class=\"abc__textblock size--article\" data-component=\"TextBlock\" readability=\"19.105882352941\"><\/p>\n<p><em><strong>Subscribe to our cybersecurity podcast,&nbsp;<a href=\"https:\/\/itunes.apple.com\/gb\/podcast\/cyber\/id1441708044?mt=2\" target=\"_blank\" rel=\"noopener\">CYBER<\/a>. Subscribe to&nbsp;<a href=\"https:\/\/www.twitch.tv\/motherboardtv\" target=\"_blank\" rel=\"noopener\">our new Twitch channel<\/a>.<\/strong><\/em><\/p>\n<p><\/span>READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/33365\/Hackers-Use-Malicious-Google-Ads-To-Steal-4-Million-In-Stablecoin.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[277],"tags":[9975],"class_list":["post-46352","post","type-post","status-publish","format-standard","hentry","category-cybersecurity-blogs","tag-headlinehackercybercrimedata-lossfraudgooglecryptography"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-04-25T14:49:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"432\" \/>\n\t<meta property=\"og:image:height\" content=\"435\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin\",\"datePublished\":\"2022-04-25T14:49:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\\\/\"},\"wordCount\":768,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"keywords\":[\"headline,hacker,cybercrime,data loss,fraud,google,cryptography\"],\"articleSection\":[\"CyberSecurity Blogs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\\\/\",\"name\":\"Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"datePublished\":\"2022-04-25T14:49:46+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,hacker,cybercrime,data loss,fraud,google,cryptography\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinehackercybercrimedata-lossfraudgooglecryptography\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/","og_locale":"en_US","og_type":"article","og_title":"Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-04-25T14:49:46+00:00","og_image":[{"width":432,"height":435,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin","datePublished":"2022-04-25T14:49:46+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/"},"wordCount":768,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"keywords":["headline,hacker,cybercrime,data loss,fraud,google,cryptography"],"articleSection":["CyberSecurity Blogs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/","url":"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/","name":"Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"datePublished":"2022-04-25T14:49:46+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/hackers-use-malicious-google-ads-to-steal-4-million-in-stablecoin\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,hacker,cybercrime,data loss,fraud,google,cryptography","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinehackercybercrimedata-lossfraudgooglecryptography\/"},{"@type":"ListItem","position":3,"name":"Hackers Use Malicious Google Ads To Steal $4 Million In Stablecoin"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46352","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=46352"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46352\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=46352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=46352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=46352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}