Google served me Malware

John Hammond · 26 min

The viewer follows an analyst tracing a malvertising campaign from a fake Google Ads result through a phishing landing page and a staged PowerShell and batch loader chain. The video shows how a trojanized TortoiseSVN installer abuses DLL side-loading to deliver a Confuser-obfuscated websocket C2 implant, and how the analysis was verified with Inno Setup unpacking, comparison against the legitimate package and dynamic sandboxing.