After users click on the fake ad, they're redirected multiple times until finally landing on a fake site for Google Authenticator hosted on GitHub. If people aren't paying close attention, it's easy to miss these redirects and not notice they're on a malicious site before innocently clicking that 'Download' button.

If this fraudulent Google Authenticator is successfully downloaded on your device, the malware — known as DeerStealer and originally discovered by @anyrun_app on X — will have access to your personal data, specifically via an "attacker-controlled website hosted at vaniloin[.]fun."

With such well-concealed malware floating around on the internet, how are you supposed to protect yourself? Well, there are a few specific tips to prevent this malware and an all-encompassing solution that could keep you protected without needing to manually vet all links.

How to notice DeerStealer malware

Most of us are familiar with what a sponsored ad on Google looks like, and looking at the malicious ad Malwarebytes took screenshots of, it's hard to spot the differences. The ad shows Google's official website as the URL, and when you expand details about the advertiser, it convincingly reads "Advertiser identity verified by Google."

fake google authenticator ad

Even if you accidentally click on this fake ad from 'Larry Marr,' your device isn't compromised just yet. The DeerStealer malware only gains access to your personal data if you don't recognize the suspicious URL — chromeweb-authenticators[.]com — and download the malicious Authenticator[.]exe file.

malwarebytes screenshot

Unfortunately, your browser's built-in security measures will not recognize this fake site and file as malicious because they are hosted on GitHub, a trusted cloud resource.

So what is a security-conscious user to do?

The only solution that could protect you from this advanced malware without needing to diligently check every URL yourself is antivirus software. Malwarebytes points out that its own antivirus software detected the malicious payload as "Spyware.DeerStealer," and there are multiple other antivirus solutions available that would work similarly.

Even taking precautions the modern internet is a hazardous place, so investing in one of the best antivirus apps that is available for desktop and mobile is the best solution to keep yourself as safe as possible.