Topic starter
10/06/2026 11:59 pm
TL;DR: Attackers are using malvertising that impersonates Ahrefs on Google Search to push AITM phishing pages that steal Google accounts and sessions, expanding a campaign already seen against ad manager users, according to Push Security. The real problem is that ad manager identities are also enterprise access paths, so browser-based interception is now an identity control issue, not just a phishing problem.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “Google Search malvertising campaign continues, now impersonating Ahrefs”.
Key questions
Q: How should teams reduce risk from search-delivered phishing against ad manager users?
A: Treat search-delivered phishing as a browser security and identity issue, not only a user-training problem.
Q: Why do ad manager accounts create broader enterprise identity risk?
A: Ad manager accounts often reuse the same identity that already reaches core SaaS systems through SSO.
Q: What are the signs that an AITM phishing campaign is targeting identity sessions?
A: Look for cloned login pages, suspicious redirects from sponsored results, repeated MFA prompts, and authentication flows that end in session theft rather than password-only capture.
Practitioner guidance
- Classify ad manager accounts by access blast radius Inventory which advertising, marketing, and agency identities can reach Google Workspace or other SSO-connected apps.
- Harden browser-side detection for search-delivered phishing Extend monitoring and blocking beyond email into the web browser, where sponsored results and cloned login flows actually execute.
- Review account-linking and alternate login paths Check whether email-based matching, new-login-method prompts, or weak reauthentication rules allow a compromised identity provider account to open access to other applications without strong additional verification.
Bottom line: Ahrefs impersonation through Google Search shows how malvertising can be used to drive AITM phishing against accounts that also function as enterprise access paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 6:28 am
Ad manager identities are no longer peripheral accounts: they now sit on trust paths into core enterprise access. When a marketing or advertising login can reach Google Workspace or other SSO-enabled apps, compromise of that identity is an access governance event, not a niche campaign issue. Practitioners need to classify these accounts by blast radius, not by department label.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should organisations treat marketing and ad identities as privileged access?
A: Yes, if those identities can reach Google Workspace, customer data, billing systems, or other connected applications. The right test is not whether the account belongs to marketing, but whether compromise of that account creates a path into business-critical systems. Where that is true, ad identities need privileged-identity governance, not casual exemption.
👉 Read our full editorial: Ahrefs impersonation attacks expose ad-manager identity risk
This post was modified 1 day ago by NHI Mgmt Group