This malware is posing as Google Authenticator using Google ads — here's how to protect yourself

Recent malware attacks have become more advanced, and the advice to keep your device safe is no longer as easy as "Don't click on any random links sent to you." Threat actors are seeking victims out with more concealed measures, like this fake ad for Google Authenticator that looks like the real deal, identified in a July 30 report by Malwarebytes .

After users click on the fake ad, they're redirected multiple times until finally landing on a fake site for Google Authenticator hosted on GitHub. If people aren't paying close attention, it's easy to miss these redirects and not notice they're on a malicious site before innocently clicking that 'Download' button.

If this fraudulent Google Authenticator is successfully downloaded on your device, the malware — known as DeerStealer and originally discovered by @anyrun_app on X — will have access to your personal data, specifically via an "attacker-controlled website hosted at vaniloin[.]fun."

With such well-concealed malware floating around on the internet, how are you supposed to protect yourself? Well, there are a few specific tips to prevent this malware and an all-encompassing solution that could keep you protected without needing to manually vet all links.

How to notice DeerStealer malware

Most of us are familiar with what a sponsored ad on Google looks like, and looking at the malicious ad Malwarebytes took screenshots of, it's hard to spot the differences. The ad shows Google's official website as the URL, and when you expand details about the advertiser, it convincingly reads "Advertiser identity verified by Google."

Even if you accidentally click on this fake ad from 'Larry Marr,' your device isn't compromised just yet. The DeerStealer malware only gains access to your personal data if you don't recognize the suspicious URL — chromeweb-authenticators[.]com — and download the malicious Authenticator[.]exe file.

Unfortunately, your browser's built-in security measures will not recognize this fake site and file as malicious because they are hosted on GitHub, a trusted cloud resource.

So what is a security-conscious user to do?

The only solution that could protect you from this advanced malware without needing to diligently check every URL yourself is antivirus software. Malwarebytes points out that its own antivirus software detected the malicious payload as "Spyware.DeerStealer," and there are multiple other antivirus solutions available that would work similarly.

Even taking precautions the modern internet is a hazardous place, so investing in one of the best antivirus apps that is available for desktop and mobile is the best solution to keep yourself as safe as possible.

More from Laptop Mag

• Snapdragon X PCs to rival MacBook Air in more than performance from 2025
• Logitech considers releasing a mouse you buy once and pay for 'forever'
• How to change Apple ID password: Cybersecurity experts say to do it every 90 days (but now is better than never)