Security researchers say Google’s ad platform has been weaponized for over a year, with threat actors running fake sponsored links that funnel unsuspecting crypto users to phishing sites designed to drain their wallets.
How The Attack WorksAttackers either purchase ad space outright or break into existing advertiser accounts to run the fake listings, then outbid the real protocol to secure the top position.
Victims who click through land on convincing replicas of the real Uniswap platform, with all their network activity routed silently through attacker-controlled servers.
Community alert:
A website impersonating Uniswap is draining funds from multiple wallets.
The scammers are currently holding at least ~$400,000.
At the time of writing, two flagged wallets held a combined 146 ETH, valued at roughly $306,000. The total haul is estimated at at least $400,000.
A Year Of LossesThe nonprofit Security Alliance, known as SEAL, has been tracking the broader pattern. According to the group, there was a sharp rise in this type of phishing activity in March, with $1.27 million stolen between March 13 and 30 alone.
SEAL said it blocked more than 356 malicious ad links, describing that number as typical of weekly attacker activity sustained for more than a year — and said the pace has not slowed.
DeFiLlama, a crypto data platform, echoed the concern, calling fake Google ads a common and recurring source of phishing attacks targeting the crypto community.
It’s insane that Google has ignored this issue for years while fake links keep getting pushed above real ones and users keep getting drained.
The Threat Spreads Beyond GoogleThe Uniswap case is part of a wider pattern hitting multiple platforms and audiences. Reports indicate that in early May, attackers were abusing both Google Ads and shared chat links from AI tools to push malware targeting Mac users in an active campaign.
Meanwhile, reports note that Facebook has seen a similar wave of fake paid ads, with scammers mimicking official Microsoft promotions and directing users to counterfeit Windows 11 download pages loaded with credential-stealing malware.
SEAL said it continues to receive reports from victims and that the campaign shows no sign of stopping.
Featured image from Unsplash, chart from TradingView
