CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

1Campaign Platform Facilitates Prolonged Malicious Google Ads

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A cybercrime service called 1Campaign enables threat actors to run malicious Google Ads that evade detection by security researchers. The platform uses cloaking techniques to show benign content to researchers while directing malicious content to potential victims. Operated by a developer known as 'DuppyMeister,' 1Campaign has been active for at least three years and provides a user-friendly dashboard for managing campaigns. The platform filters visitors in real-time based on geography, ISP, and device characteristics, allowing attackers to focus on relevant regions while avoiding scrutiny. In one instance, 99.4% of visitors were blocked, resulting in a success rate of just 0.6%. The system assigns a fraud risk score to each visitor, flagging those from cloud providers and security vendors. 1Campaign has been observed distributing traffic in multiple countries, including the United States, Canada, and Germany. The platform also offers a Google Ads launcher tool that helps operators bypass Google's policy limitations and impersonate legitimate brands. Despite Google's safeguards, 1Campaign's cloaking system makes static URL scanning less effective, necessitating more sophisticated detection methods.

Timeline

  1. 24.02.2026 23:45 1 articles · 2h ago

    1Campaign Platform Enables Prolonged Malicious Google Ads

    A cybercrime service called 1Campaign enables threat actors to run malicious Google Ads that evade detection by security researchers. The platform uses cloaking techniques to show benign content to researchers while directing malicious content to potential victims. Operated by a developer known as 'DuppyMeister,' 1Campaign has been active for at least three years and provides a user-friendly dashboard for managing campaigns. The platform filters visitors in real-time based on geography, ISP, and device characteristics, allowing attackers to focus on relevant regions while avoiding scrutiny. In one instance, 99.4% of visitors were blocked, resulting in a success rate of just 0.6%. The system assigns a fraud risk score to each visitor, flagging those from cloud providers and security vendors. 1Campaign has been observed distributing traffic in multiple countries, including the United States, Canada, and Germany. The platform also offers a Google Ads launcher tool that helps operators bypass Google's policy limitations and impersonate legitimate brands. Despite Google's safeguards, 1Campaign's cloaking system makes static URL scanning less effective, necessitating more sophisticated detection methods.

    Show sources
    Open in new tab

Information Snippets

  • 1Campaign is a cloaking service that passes Google's screening process and shows malicious content only to real potential victims.

    First reported: 24.02.2026 23:45
    1 source, 1 article
    Show sources

  • The platform is managed by a developer using the name 'DuppyMeister' and has been active for at least three years.

    First reported: 24.02.2026 23:45
    1 source, 1 article
    Show sources

  • 1Campaign provides a user-friendly dashboard for managing campaigns and filtering visitors in real-time based on geography, ISP, and device characteristics.

    First reported: 24.02.2026 23:45
    1 source, 1 article
    Show sources

  • The system assigns a fraud risk score to each visitor, flagging those from cloud providers and security vendors.

    First reported: 24.02.2026 23:45
    1 source, 1 article
    Show sources

  • 1Campaign has been observed distributing traffic in multiple countries, including the United States, Canada, and Germany.

    First reported: 24.02.2026 23:45
    1 source, 1 article
    Show sources

  • The platform offers a Google Ads launcher tool that helps operators bypass Google's policy limitations and impersonate legitimate brands.

    First reported: 24.02.2026 23:45
    1 source, 1 article
    Show sources

  • Varonis recommends rotating through a diverse IP pool and user-agent configurations for better automated detection.

    First reported: 24.02.2026 23:45
    1 source, 1 article
    Show sources