We've seen several recent reports of consumers downloading malware served to them through search engine advertising, especially promoted search results on websites like Google.  

This is a sophisticated phishing effort where scammers spoof legitimate websites (like Grammerly and Slack) and pay search engines for advertising. In return, the spoofed websites are pushed to the top of web search results for certain keywords. Once a person clicks on the link in the ad, they might download malware, ransomware, or become a victim of some other scheme.  

What should I do? 

Our recommendation is to be very careful about clicking on sponsored search results, which are usually clearly marked as an "Ad" next the webpage title. Make sure any link you click on from a sponsored search result is a legitimate website; however, this can be difficult because the cybercriminals try to spoof URLs very carefully. To be safe, you can always scroll down to relevant, unsponsored search results that link to web addresses you know are legitimate.  

As with all online activity, think before you click! Even taking the time it takes to count to three to vet a link is worth it. This additional awareness won't really slow you down, and it could save you countless hours spent recovering your computer from a virus.   

Additional Resources

• Federal Trade Commission: Online search results: The good, the bad, and the scammy

• Federal Trade Commission: Are These Search Results Paid For?