SentinelOne researchers recently discovered an emerging “Zloader” campaign utilizing a new, stealthier infection chain to disable Microsoft Defender Antivirus in order to evade detection and deploy the malware onto machines. SentinelOne released a report, which is linked below, that explains that the emerging campaign involves the delivery vector of fraudulent TeamViewer Google advertisements published through Adwords as opposed to phishing emails. Once a user clicks on the advertisement, the victim is redirected to a fraudulent download site where they are lured into downloading signed and malicious MSI installers, which then installs the “Zloader” malware payloads onto their systems. SentinelOne researchers emphasized that the threat actor obtained a valid certificate issued by Flyintellect Inc, which is a Software company based in Canada, that was just registered in late June 2021. Researchers suggested that the threat actors potentially registered the company for the purpose of obtaining the certificate. Antonio Pirozzi, SentinelOne Senior Threat Intelligence Researcher, emphasized that this overall compromise technique reaches a higher level of stealthiness, as “the technique used to install the first stage dropper has been changed from socially engineering the victim into opening a malicious document to poisoning the user’s web searches with links that deliver a stealthy, signed payload”. It is believed that the campaign targets users of Australian and German financial institutions to gain bank credentials via intercepting users’ web requests to banking portals. CTAPT analysts will continue to monitor for threat actors utilizing fraudulent Google advertisements as campaign delivery vectors.