Ahrefs impersonation attacks expose ad-manager identity risk

At a glance

What this is: This is a threat analysis showing how Ahrefs impersonation ads on Google Search are being used to drive AITM phishing against Google account holders.

Why it matters: It matters because ad manager accounts often sit on the path to broader Google access and connected apps, so phishing against them can become enterprise access compromise.

Context

The security gap here is not simply fake ads. It is the assumption that a marketing or ad platform account is operationally separate from the rest of the identity estate when, in practice, it often becomes a gateway into Google Workspace and other SSO-enabled applications. For identity teams, that makes browser-based phishing against ad manager users an access governance problem as much as a user-awareness problem.

Push Security describes a campaign that moved from fake Google Ads malvertising to Ahrefs impersonation, then to a cloned login flow designed to capture credentials and session state. The article also notes updated activity via surge.sh-hosted domains and similar impersonation of Semrush, which shows how quickly these lures can be repackaged across adjacent brands.

Key questions

Q: How should teams reduce risk from search-delivered phishing against ad manager users?

A: Treat search-delivered phishing as a browser security and identity issue, not only a user-training problem. Focus on real-time inspection of landing pages, blocking suspicious redirects, and enforcing stronger access controls for accounts that can reach enterprise SSO applications. If an ad manager login can unlock broader SaaS access, it deserves the same scrutiny as any privileged identity.

Q: Why do ad manager accounts create broader enterprise identity risk?

A: Ad manager accounts often reuse the same identity that already reaches core SaaS systems through SSO. When a compromise of one account can open another application with the same email identity or linked login path, the attacker gains more than campaign access. The practical risk is identity pivoting across applications, not just abuse of the ad platform itself.

Q: What are the signs that an AITM phishing campaign is targeting identity sessions?

A: Look for cloned login pages, suspicious redirects from sponsored results, repeated MFA prompts, and authentication flows that end in session theft rather than password-only capture. If the attacker can turn a normal login into a usable browser session, the campaign is designed to bypass single-factor assumptions after the credentials are entered.

Q: Should organisations treat marketing and ad identities as privileged access?

A: Yes, if those identities can reach Google Workspace, customer data, billing systems, or other connected applications. The right test is not whether the account belongs to marketing, but whether compromise of that account creates a path into business-critical systems. Where that is true, ad identities need privileged-identity governance, not casual exemption.

Technical breakdown

Google Search malvertising as the initial access path

The attack starts with sponsored results that imitate a legitimate product search and route the victim to a controlled landing page. This is effective because the user is already in a browse-and-click mindset, and the fake ad sits inside the normal search experience rather than in email or endpoint-driven delivery. The campaign can also be retargeted by location, device type, or email domain, which makes the lure more precise than broad phishing. From an identity perspective, the delivery channel matters because it bypasses the controls many organisations still rely on for phishing detection.

Practical implication: Treat search-ad exposure as part of your identity attack surface, not just your web-filtering problem.

AITM phishing turns authentication into session theft

The cloned Ahrefs page is only the bait. The important mechanism is the redirect to a Google sign-in flow that behaves like an attacker-in-the-middle proxy, capturing credentials and the post-MFA app session. That means the attacker is not only learning a password, but also obtaining the authenticated browser session needed to act as the user. In practice, this is why MFA alone is not a complete barrier when the adversary can intercept the live authentication exchange and reuse the resulting session.

Practical implication: Assure that authentication controls are evaluated for session theft resistance, not only for password or MFA prompt coverage.

Ad manager identities are also downstream SSO entry points

The deeper governance problem is that ad manager accounts often double as enterprise identity footholds. If the same mailbox or login identity can reach Google Workspace or other connected apps through SSO, then compromise of an ad platform account becomes a broader identity compromise. This is especially risky where account linking, email-based identity matching, or alternate login methods reduce the number of checks required before access is granted. The result is a cross-IdP trust problem, not a single-app compromise.

Practical implication: Map which ad and marketing identities can pivot into core SaaS access before you assume they are low-value accounts.

Threat narrative

Attacker objective: The attacker wants durable access to Google accounts and the downstream SaaS access that those accounts unlock.

1. Entry occurs through a fake sponsored result on Google Search that impersonates Ahrefs and leads the victim to a malicious landing page.
2. Credential capture happens when the victim follows the cloned Google sign-in path and enters credentials into an attacker-controlled AITM flow.
3. Escalation occurs when the attacker steals the authenticated app session after MFA, allowing account takeover without needing the password again.
4. Impact follows when the compromised identity can be used to access Google Workspace and connected SSO applications, extending the breach beyond the initial ad account.

Breaches seen in the wild

• Google API Keys Exposure — Gemini AI: Google API keys exposed in client-side code via Gemini AI integrations, creating data leak risk.
• Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ad manager identities are no longer peripheral accounts: they now sit on trust paths into core enterprise access. When a marketing or advertising login can reach Google Workspace or other SSO-enabled apps, compromise of that identity is an access governance event, not a niche campaign issue. Practitioners need to classify these accounts by blast radius, not by department label.

Browser-mediated phishing collapses the value of email-centric controls: the delivery channel now lives in search results, sponsored links, and cloned login pages rather than inboxes. That shifts the control boundary toward browser-layer inspection, session protection, and identity-aware enforcement at the point of interaction. Security teams that still treat phishing as an email problem are defending the wrong surface.

Cross-IdP impersonation exposes a trust assumption in account linking: many programmes assume that a verified login path to one identity provider does not materially alter access elsewhere. That assumption fails when email-based matching and alternate sign-in methods let a compromised Google identity move into adjacent apps with little additional verification. The implication is that identity teams must govern linking rules as carefully as primary authentication.

Identity attack surface now includes ad ecosystems and search infrastructure: malvertising lets attackers place identity theft close to legitimate discovery behaviour, where users expect to click and continue. That creates a broader governance problem around exposure, because users with access to high-value SaaS systems can be reached through channels outside traditional security instrumentation. The practitioner takeaway is to treat search and advertising workflows as identity risk-bearing surfaces.

Session theft is the real control failure, not just credential capture: the campaign succeeds because it turns a one-time authentication event into persistent access through stolen browser state. That means the relevant control question is whether a programme can still contain a user after the MFA step has been defeated in transit. Teams should prioritise controls that reduce the value of a captured session, not only those that harden initial login.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Search-delivered phishing is now part of identity governance: when attackers can place fake login journeys inside sponsored results, the control problem moves outside the inbox and into the browser. Programmes that still anchor phishing defence in email telemetry will miss the delivery path that matters most here.

Cross-IdP trust is the named concept this campaign exposes: a compromised identity in one provider can become access in another when matching logic, alternate login methods, or weak reauthentication checks are too permissive. That means identity architects need to review account-linking logic as a security boundary, not a convenience feature.

For practitioners

• Classify ad manager accounts by access blast radius Inventory which advertising, marketing, and agency identities can reach Google Workspace or other SSO-connected apps. Mark any account that can pivot into broader enterprise access as high risk, regardless of business function.
• Harden browser-side detection for search-delivered phishing Extend monitoring and blocking beyond email into the web browser, where sponsored results and cloned login flows actually execute. Prioritise real-time inspection of page behaviour, redirects, and credential entry points.
• Review account-linking and alternate login paths Check whether email-based matching, new-login-method prompts, or weak reauthentication rules allow a compromised identity provider account to open access to other applications without strong additional verification.
• Reduce the value of stolen sessions Use conditional access and session controls that limit what an authenticated browser session can do after initial login, especially for users with access to ad platforms, admin consoles, or connected SaaS tools.

Key takeaways

• Ahrefs impersonation through Google Search shows how malvertising can be used to drive AITM phishing against accounts that also function as enterprise access paths.
• The attack works because credentials are only part of the compromise; the stolen browser session can carry the attacker past MFA and into connected applications.
• Identity teams should map ad manager and marketing accounts by downstream access, then harden browser-side detection and account-linking rules accordingly.

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Malvertising: The use of online ads to distribute malicious links or payloads. In this context it places cloned developer tool pages ahead of legitimate results, giving the attacker a trusted-looking entry point without needing an email campaign or direct social contact.
• Cross-IdP Trust: Cross-IdP trust is the practical dependence one identity provider has on another when the same email, login method, or account-linking path grants access across systems. It becomes a security issue when compromise in one identity domain can unlock another without meaningful re-verification.
• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.

Deepen your knowledge

NHI governance, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.