A series of malicious campaigns have been identified, targeting individuals and businesses through various means. A malvertising campaign has been active since mid-November 2024, targeting Google Ads users with fake ads that redirect to phishing sites hosted on Google Sites, stealing credentials and two-factor authentication codes to take over accounts and push more fake ads. Additionally, cybercriminals are using Google search ads to promote phishing sites that steal advertisers’ credentials, with at least three (3) groups, including Portuguese speakers, behind the attacks. Meanwhile, a malware campaign has compromised over 5,000 WordPress sites, creating admin accounts, installing malicious plugins, and stealing sensitive data. Furthermore, threat actors are distributing information stealer malware disguised as proof-of-concept (PoC) exploit code for a recent Windows Lightweight Directory Access Protocol (LDAP) vulnerability, which can crash unpatched Windows servers. The fake PoC exploit collects system information, including process lists and network adapter information, and uploads it to an external FTP server. These campaigns highlight the ongoing threats to online security, with Google acknowledging the issues and working to address them, having already removed billions of ads and suspended millions of advertiser accounts for violating its policies. CTIX analysts will continue to report on novel malware strains and attack methods in future FLASH Update issues.