Watch out – these fake ads for Slack and Cisco are just malware

Researchers from eSentire observed a new campaign aiming to spread Nitrogen malware and ALPHV ransomware through hijacked Google Ads. The attackers, potentially affiliates of the Ransomware-as-a-Service BlackCat, target corporate and public entities in the Americas and Europe, using compromised Google accounts to promote fake software from popular brands. Once downloaded, Nitrogen infects endpoints, paving the way for BlackCat to encrypt data and demand ransoms.