Researchers Detail Pushpaganda’s AI-Driven Ad-Fraud Campaign
Summary
Researchers say Pushpaganda used AI-generated stories in Google Discover to lure users into enabling notifications that delivered scareware and scams. The campaign was linked to 240 million bid requests across 113 domains in a week; Google says it rolled out a fix.
Key points
- HUMAN researchers say Pushpaganda used SEO poisoning and AI-generated stories to appear in Google Discover feeds.
- Users were tricked into enabling browser notifications that delivered fake legal threats, scareware, and financial scams.
- Researchers linked the campaign to about 240 million bid requests across 113 domains over seven days, with activity observed in multiple countries.
- The operators used notification clicks to direct traffic to ad-filled sites and generate illicit revenue.
- The article connects the campaign’s cashout infrastructure to broader ad-fraud operations, including Low5 and BADBOX 2.0.
- Google rolled out a fix for the spam issue, but HUMAN researchers warn that cashout domains may be reused.
Article Details
- Event Type
- Ad-fraud campaign using SEO poisoning, AI-generated stories, and deceptive browser push notifications to drive scareware and financial scams.
- Impact
- The campaign was associated with about 240 million bid requests across 113 domains in seven days. Users were directed to actor-controlled sites and prompted to enable notifications that delivered fake legal threats and scams. Google rolled out a fix for the spam issue, but researchers said cashout domains could be reused.
People
Adam SellNamed as a researcher on the report describing the Pushpaganda campaign.Gavin ReidHUMAN's chief information security officer; commented on the campaign's abuse of discovery feeds and its use to deliver scareware and financial fraud.João SantosNamed as a researcher on the report describing the Pushpaganda campaign.Lindsay KayeHUMAN Security's vice president of threat intelligence; commented on push notifications as a means of social engineering users.Louisa AbelNamed as a researcher on the report describing the Pushpaganda campaign.Vikas ParthasarathyNamed as a researcher on the report describing the Pushpaganda campaign.
Threat Actors
Vendors
Products
AndroidThe campaign, which has been found to target the personalized content feeds of Android and Chrome users, has been codenamed Pushpaganda by HUMAN’s Satori Threat Intelligence and Research Team.Google ChromeThe campaign, which has been found to target the personalized content feeds of Android and Chrome users, has been codenamed Pushpaganda by HUMAN’s Satori Threat Intelligence and Research Team.Google Discovercampaign that uses search engine poisoning and AI-generated news to push deceptive stories into Google Discover and trick users into enabling persistent browser push notifications that deliver scareware andGoogle Play StoreThe Android apps in question have been removed from the Google Play Store.
Countries
AustraliaThe threat, although observed targeting India, has since expanded to other regions like the U.S., Australia, Canada, South Africa, and the U.K.CanadaThe threat, although observed targeting India, has since expanded to other regions like the U.S., Australia, Canada, South Africa, and the U.K.IndiaThe operation generated roughly 240 million bid requests tied to 113 domains in one week, spread beyond India to several countries, and shows how shared monetization infrastructures like Low5 and BADBOX 2.0 enableSouth AfricaThe threat, although observed targeting India, has since expanded to other regions like the U.S., Australia, Canada, South Africa, and the U.K.United KingdomThe threat, although observed targeting India, has since expanded to other regions like the U.S., Australia, Canada, South Africa, and the U.K.United StatesThe threat, although observed targeting India, has since expanded to other regions like the U.S., Australia, Canada, South Africa, and the U.K.