Have you checked your accounts lately?
The ad industry had a nice laugh earlier this week when news popped about a 9-year-old who used his father’s already-logged-in Google business account to spend $118,000 on YouTube ads promoting his Minecraft and Roblox channel. His dad, a media buyer who got into hot water at work over the incident, had set a $20 limit. Whoops.
Funny story (well, maybe not for the dad). But account takeovers aren’t usually this benign, as another incident that came to light this past week demonstrates. Advertiser account security is a major cybersecurity flaw.
One not-so-comical takeover occurred when HBO MAX had its verified Reddit account overrun by a hacker group, which eluded notice for two days while it ran 108 different ad permutations targeting an unknown number of Redditors.
Cybersecurity company Hudson Rock wrote a detailed breakdown of the scam, which was orchestrated by a sophisticated group with links to previously documented cyber and ad fraud attacks.
In this case, the official HBO MAX Reddit account served ads offering different flavors of HBO MAX downloads or promos that featured convincing landing pages and the URL “hbomax.us,” which could easily fool undiscerning users. (The real URL is hbomax.com.) The campaign was identified after two days only because the scammers had the bad luck to serve an ad to a cybersecurity pro in the r/cybersecurity subreddit, blowing their cover.
“After learning of the issue, we locked the account, removed the ads and began working with HBO Max to strengthen its account security,” a Reddit spokesperson told AdExchanger in an email.
Warner Bros. Discovery, which owns HBO MAX, did not respond to request for comment.
AdExchanger was told by a party with knowledge of the account takeover that it was the result of a compromised account from someone working on the HBO MAX team. “User error” is generally the root cause of account takeover scams.
Google Ads and Merchant Center account operators have been plagued for years by sophisticated fraudsters who swipe their budgets. But vampires need to be invited in.
Bad actors typically require a moment of human gullibility or naivety to get their foot in the door, like, for example, foolhardily doing a search for “Google Ads account” and then hitting the top link.
Sometimes that link is a scammer’s ad, and users end up authenticating the multifactor token because they think they’re actually logging into the account. In fact, they’re authorizing someone else.
In the case of the crew that took over HBO MAX’s Reddit account, they ran several scam ad campaigns at once, targeting people with different ad experiences and routing them to data harvesting pages based on whether they had cryptocurrency wallets, say, or were on a Mac, Android or Windows device.
Taking on takeovers
The growing prevalence of ad account takeover scammers should make it clear that we need new standards and best practices to guard against them.
One way is for platforms to prod their ad customers to improve their own practices, like Reddit did when it noted that it immediately “began working with HBO Max to strengthen its account security.”
Reddit clearly wants other advertisers to know the breach happened on HBO Max’s end, not Reddit’s.
Although platforms can also do more than point the finger and publish best practices.
In August, for example, Google took steps to shore up account security by requiring all Ads API account users to log in using a device authenticator app or passkey (which is a biometric sign-in like a fingerprint or facial recognition). New passkeys are now also placed in a week-long “trust period” before they can unlock budgets.
There’s lower-hanging fruit, however, that isn’t being addressed.
Reddit could at least notify every user who clicked on or was served one of the HBO MAX scam ads. Likewise, Google and Meta could inform users if they’ve clicked on an ad that turns out to be part of a known crypto scam, for instance. But none of the platforms do this.
Some scams take days or weeks to play out, and victims don’t know they’re victims. Software installed from a fake ad can quietly hand control of a device to someone else or lift saved passwords from their Notes app, including the answers to security questions for their bank and crypto accounts.
People who are scammed out of their Google Ads credentials are immediately aware, and so those fraudsters act fast. On an account that buyers may not be checking regularly, though, like Reddit, a bad actor could lurk for days without their activity drawing notice. Catching the HBO scammers within two days was pure luck.
Stay safe out there.
