{"id":817,"date":"2023-01-26T13:35:56","date_gmt":"2023-01-26T13:35:56","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/google-oglasi-kao-novi-vektor-napada\/"},"modified":"2026-11-04T08:44:04","modified_gmt":"2026-11-04T08:44:04","slug":"google-oglasi-kao-novi-vektor-napada","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/novosti\/google-oglasi-kao-novi-vektor-napada\/","title":{"rendered":"Google oglasi kao novi vektor napada?"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Napada\u010di su po\u010deli postavljati <strong>la\u017ene web stranice<\/strong> za popularne i besplatne open-source programe, zatim <strong>za njih pla\u0107aju oglase<\/strong> kako bi se te stranice prikazale prve u rezultatima Google pretrage, te putem njih distribuiraju<strong> zlonamjerni sadr\u017eaj.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Nacionalni CERT zaprimio je nekoliko prijava koje ukazuju na kori\u0161tenje ove vrste prijevare za ciljanje korisnika u Hrvatskoj. Zasad su zabilje\u017eene imitacije stranica raznih financijskih institucija i sve su prijavljene nadle\u017enim tijelima.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-push-malware-via-google-search-ads-for-vlc-7-zip-ccleaner\/\">Bleepingcomputer<\/a> navodi kako je poznati trgovac kriptovaluta i NFT-a, Alex (poznatiji kao NFT God), postao \u017ertva napada nakon \u0161to je pokrenuo zlonamjerni k\u00f4d, u zabludi da se radi o Open Broadcaster Software \u2013 programu za snimanje i preno\u0161enje videa u\u017eivo.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a09bca53c&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a09bca53c\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/01\/image.png\" alt=\"\" class=\"wp-image-110498\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>Izvor: bleepingcomputer.com<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Alex je napisao kako se ni\u0161ta nije dogodilo prilikom pokretanja .exe datoteke, ali nakon nekoliko sati prijatelji su mu javili kako mu je \u201e<em>hakiran\u201c <\/em>korisni\u010dki ra\u010dun na Twitteru. Ubrzo je shvatio da se ne radi o softveru za snimanje i streaming videa, ve\u0107 o malveru koji je ukrao lozinke spremljene u pregledniku njegovog ra\u010dunala, kola\u010di\u0107e, tokene i kriptovalute te ih poslao napada\u010du.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a09bcace7&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a09bcace7\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/01\/image-2.png\" alt=\"\" class=\"wp-image-110500\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>Izvor: <a href=\"https:\/\/twitter.com\/NFT_GOD\/status\/1614442008180887553\">Twitter<\/a><\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">U pojedinim slu\u010dajevima se radilo o <strong>RedLine Stealeru<\/strong>, softveru koji prikuplja podatke iz preglednika (korisni\u010dke podatke, podatke o kreditnim karticama, automatsko popunjavanje i sl.), podatke o sustavu (korisni\u010dko ime, lokacija, hardver, softvere) i kriptovalutama.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Otkriveno je da se na ovaj na\u010din \u0161iri i trojanac <strong>SectoRAT<\/strong>, poznat i kao Arechclient2, a koji napada\u010du omogu\u0107ava udaljeni pristup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Broj oglasa za zlonamjerne stranice je u zna\u010dajnom porastu, a OBS je samo jedna u nizu \u017ertava imitacije za ovu vrstu napada.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Napad se izvr\u0161ava na sljede\u0107i na\u010din:\n\nNapada\u010d registrira domenu sli\u010dnog naziva i kopira stil legitimne stranice kako bi la\u017ena stranica \u0161to vi\u0161e sli\u010dila legitimnoj.\n\nPreuzeti zlonamjerni sadr\u017eaj je skriven unutar ZIP datoteke te ga antivirusni programi te\u0161ko otkrivaju. <\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">CronUp je objavio <a href=\"https:\/\/raw.githubusercontent.com\/CronUp\/Malware-IOCs\/main\/2023-01-17_Arechclient2_GoogleAds\">listu 70 domena<\/a> koje distribuiraju zlonamjerni k\u00f4d putem Google oglasa imitiraju\u0107i legitimne softvere. Ogla\u0161avane stranice su replike legitimnih stranica ili preusmjeravaju na drugu stranicu za preuzimanje sadr\u017eaja.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">U poznatije softvere koje se imitira ovom vrstom prijevare spadaju:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>7-Zip<\/li><li>Blender 3D<\/li><li>Capcut<\/li><li>CCleaner<\/li><li>Notepad++<\/li><li>OBS<\/li><li>Rufus<\/li><li>VirtualBox<\/li><li>VLC Media Player<\/li><li>WinRAR<\/li><li>Putty<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>KAKO SE ZA\u0160TITIT?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Prije svega, potrebno je obratiti pa\u017enju na naziv domene i URL s kojeg preuzimamo sadr\u017eaj.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Trebate biti oprezni i prepoznati prijevaru na vrijeme.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kako bi sa\u010duvali svoje korisni\u010dke podatke ne spremajte lozinke unutar preglednika.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kori\u0161tenjem Ad-blockera mo\u017eete umanjiti \u0161ansu da nasjednete na la\u017ene oglase, jer Ad-blockeri onemogu\u0107uju prikaz oglasa u va\u0161em pregledniku.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ad-blockeri tako\u0111er onemogu\u0107uju pra\u0107enje va\u0161ih kola\u010di\u0107a u marketin\u0161ke svrhe. <\/p>","protected":false},"excerpt":{"rendered":"<p>Napada\u010di su po\u010deli postavljati la\u017ene web stranice za popularne i besplatne open-source programe, zatim za njih pla\u0107aju oglase kako bi se te stranice prikazale prve u rezultatima Google pretrage, te putem njih distribuiraju zlonamjerni sadr\u017eaj. Nacionalni CERT zaprimio je nekoliko prijava koje ukazuju na kori\u0161tenje ove vrste prijevare za ciljanje korisnika u Hrvatskoj. Zasad su [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1103,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[12],"tags":[],"tema":[],"class_list":["post-817","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=817"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/817\/revisions"}],"predecessor-version":[{"id":1107,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/817\/revisions\/1107"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1103"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=817"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=817"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}