Google Ad Manager account takeovers are powering malvertising scams

At a glance

What this is: Push Security examines how attackers are taking over Google Ad Manager accounts to run malvertising, monetise ad spend, resell access and abuse downstream SSO-linked services.

Why it matters: IAM, PAM and NHI teams need to treat advertising accounts as high-value identity assets because compromise can expand beyond ad operations into broader SaaS access and revenue loss.

Context

Google Ad Manager account compromise is an identity problem, not just an ad fraud problem. Once attackers obtain access, they can change campaigns, redirect spend, resell the account, or use the same email-based identity to reach linked services.

The attack path in this article starts with phishing and malicious sites impersonating marketing tools, then moves through AITM capture of Google credentials and session theft. That makes the control gap broader than email filtering, because the abuse happens in the browser and often inside trusted commercial accounts.

Key questions

Q: What breaks when a Google Ad Manager account is phished?

A: The account stops being a bounded marketing tool and becomes a reusable access token for fraud, malvertising and broader SaaS compromise. Attackers can redirect spend, alter campaigns, sell access, or use the same identity path to reach connected services. The failure is not only credential theft, but loss of control over business authority.

Q: Why do compromised advertising accounts create such a large blast radius?

A: They carry trust, spend authority and relationships that normal fraud controls may not scrutinise closely. When the same identity also opens paths into Google Workspace or other SaaS apps, one takeover can spread well beyond ads. The blast radius grows because the account is both operationally privileged and commercially valuable.

Q: How can security teams detect ad account abuse before budgets are exhausted?

A: Look for new campaigns, unfamiliar destination URLs, abrupt spend spikes, account recovery changes and campaign edits that do not fit normal marketing activity. These signals often appear before the compromise is obvious to finance or marketing. Detection works best when IAM, marketing operations and finance share telemetry.

Q: How should organisations govern marketing accounts that also reach SSO-linked apps?

A: Treat them as business-critical identities with explicit ownership, review and recovery controls, not as casual team logins. Restrict shared access, document downstream application reach, and remove unnecessary login reuse across SaaS tools. If the same identity opens multiple doors, governance has to cover every door it can open.

Technical breakdown

Phishing and AITM capture of advertising identities

The initial access pattern is classic credential theft adapted to a commercial target. Attackers use phishing, fake marketing tools, and AITM pages to intercept Google credentials and session material in the browser. In practice, that means the identity is taken at the point of login, not after a password guess or infrastructure exploit. Once the session is captured, the attacker can act as the legitimate account holder inside Google Ad Manager or related Google services. Practical implication: browser-layer identity controls matter when the login surface is the attack surface.

Practical implication: shift detection and protection toward browser-based session theft, not only mailbox filtering.

How a hijacked ad account becomes a fraud platform

A compromised ad account is valuable because it already has spending authority, trust history, and live campaign structure. Attackers can create new campaigns, modify existing ones, or route ad spend to low-quality or malicious pages that generate fraudulent clicks and impressions. That is why ad fraud scales so quickly in accounts with established budgets and relationships. The account itself becomes the billing and distribution mechanism for abuse, which is very different from simply stealing static data. Practical implication: account spending limits and campaign-change monitoring are core security signals, not just finance controls.

Practical implication: watch for campaign edits, spend spikes, and unfamiliar destination URLs inside trusted ad accounts.

Why SSO-linked access widens the blast radius

The article also shows why these accounts cannot be treated as isolated business tools. A Google Ad Manager identity may also function as a Google Workspace account and, through email-based matching, as a doorway into other SaaS applications that accept the same address or a reused login path. That makes identity binding brittle when the same principal is used across commercial, collaboration, and downstream application access. The result is a larger blast radius from one compromised browser session. Practical implication: map where a marketing identity can authenticate beyond the ad platform itself.

Practical implication: inventory downstream SaaS access tied to marketing identities and remove assumptions that the ad account is self-contained.

Threat narrative

Attacker objective: The attacker wants monetisable access to trusted advertising accounts, campaign spend, and downstream identities that can be sold, abused, or leveraged for extortion.

1. Entry occurs through phishing lures, impersonated marketing tools, and AITM pages that steal Google credentials and session material.
2. Credential access follows when the attacker captures the victim's browser session and reuses it against Google Ad Manager or related Google services.
3. Escalation happens as the compromised account is used to create or alter campaigns, redirect ad spend, or move into broader SSO-linked access.
4. Impact includes malvertising, ad fraud, account resale, extortion, data theft, and financial loss from fraudulent spend or malicious campaigns.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Google Ad Manager abuse is an identity security problem hiding inside a revenue workflow. The account is valuable because it combines authentication, billing authority, and downstream application reach. Once compromised, it becomes both a fraud instrument and a pivot point into broader SaaS access. Practitioners should treat commercial advertising identities as protected access paths, not just campaign admin consoles.

Browser-level identity protection is now a control boundary for high-value accounts. Email-centric anti-phishing controls miss the actual abuse path when attackers use AITM pages and malicious sites to capture active sessions in the browser. That means the security model must account for session theft, not only password theft. The practical conclusion is that identity assurance has to extend into the browser where the account is actually used.

Cross-application identity reuse turns a marketing account compromise into an enterprise access event. The article shows how a Google identity can reach Google Workspace and other SaaS services via email-based account matching and SSO-linked login paths. That creates an identity propagation problem: one taken-over commercial account can expose multiple business systems. Teams need to understand where commercial identities are accepted as general-purpose access credentials.

Ad accounts now expose a governance gap between finance, marketing and IAM. Large spend limits, billing relationships and campaign trust make these identities operationally powerful, but many governance models still leave them outside strict access review and privileged session oversight. That gap is where abuse scales. The implication is that identity governance must follow business authority, not org-chart boundaries.

Malvertising has become a distribution layer for identity compromise, not only a nuisance ad problem. Once attackers control trusted ad inventory, they can use it to deliver more phishing, steal more sessions and compound access into adjacent environments. That creates a recursive abuse loop built on trust. Practitioners should think in terms of identity-to-identity propagation, not isolated ad incidents.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Identity blast radius is the right framing for this problem. The compromise starts as a marketing-account takeover but quickly becomes a broader access event when the same identity can reach Google Workspace and other SaaS applications. Teams should map where commercial accounts are accepted as general-purpose login paths and reduce that reuse before it becomes the next pivot point.

Browser-mediated identity attacks are bypassing traditional phishing assumptions. The article's attack pattern does not depend on inbox delivery alone. It depends on the user completing a login flow in the browser, which means practical defence has to include session protection, malicious-site detection and tighter control over recovery paths.

For practitioners

• Audit high-value advertising identities Map every Google Ad Manager, Google Ads and MCC account to the business systems and SaaS services it can reach, including any SSO-linked applications.
• Harden browser-side session protection Prioritise controls that detect AITM phishing, session theft and malicious login flows inside the browser rather than relying only on email filtering.
• Separate campaign authority from account recovery Remove excessive recovery paths, shared access and informal delegation from marketing accounts so a stolen session cannot be turned into persistent control.
• Monitor ad spend and campaign mutations Alert on sudden budget exhaustion, new campaigns, destination URL changes and spend patterns that do not match normal marketing operations.
• Review downstream SaaS identity reuse Find where a marketing email address can be accepted as a login identifier in other apps and reduce that reuse where possible.

Key takeaways

• Google Ad Manager takeovers are no longer just an advertising problem because the same account can be used for malvertising, ad fraud, resale and extortion.
• The article shows attackers using phishing, fake marketing tools and AITM pages to steal Google credentials and sessions, then monetising the compromise through spend and downstream access.
• Security teams should treat marketing identities as high-value access paths and control browser-side session theft, account recovery and SSO-linked application reuse.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Malvertising: The use of online ads to distribute malicious links or payloads. In this context it places cloned developer tool pages ahead of legitimate results, giving the attacker a trusted-looking entry point without needing an email campaign or direct social contact.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.