How Google Ads crypto phishing works: Are sponsored results impersonating legitimate sites?

28 September 2026

Google Ads phishing is one of the most common ways attackers impersonate cryptocurrency exchanges, wallets, and DeFi protocols. Sponsored results appear at the top of Google search pages, and malicious actors pay to place ads that look identical to the real site. If you click a sponsored link without checking the URL, you may land on a page that steals your login credentials, seed phrase, or wallet connection.

How the scam works

Attackers create a fake website that visually matches the target - same logo, same layout, same text. They then buy Google Ads keywords for terms like "MetaMask login," "Uniswap swap," or "Ledger Live download." When you search for those terms, the ad appears above organic results. The ad's display URL may look correct, but the actual destination URL is different.

Google's ad review process can catch obvious fakes, but attackers use several techniques to slip through:

• Display URL spoofing. The ad shows a clean domain like metamask.io in the visible part, but the click-through link goes to metamask-secure-login[.]com or a similar lookalike.
• Domain squatting. Attackers register domains that differ by one character - metamask.io versus metamaskk.io - or use a different top-level domain like metamask.app.
• Cloaking. The page served to Google's ad reviewers shows the real login page. After the ad is approved, the attacker swaps the content to the phishing page. This only works if Google does not recheck the ad after approval.
• Account takeover. Attackers buy or steal existing Google Ads accounts with good history, which makes their ads look less suspicious to Google's automated checks.

What happens when you interact with the fake site

The consequences depend on the type of phishing site you land on:

• Login credential theft. You enter your email and password, and the attacker records them. If you reuse that password elsewhere, other accounts become vulnerable.
• Seed phrase capture. A fake wallet site asks you to "restore" your wallet by entering your 12 or 24-word seed phrase. Once submitted, the attacker can drain every account controlled by that seed.
• Smart contract approval phishing. The site connects your wallet (via MetaMask, WalletConnect, or another provider) and asks you to sign a transaction. If you approve an unlimited token allowance, the attacker can transfer your tokens without further permission. This is the same mechanism as Permit signature phishing, which bypasses the usual approval confirmation.
• Gasless drain. Some fake sites skip the approval step entirely. They prompt you to sign a single transaction that transfers your entire token balance to an address the attacker controls. Your wallet may warn you the transaction simulation failed, but if you ignore that and confirm, the funds are gone.

How to check a sponsored result before clicking

Do not trust the display URL in a Google Ad. Google shows a green line with a domain name, but that domain does not always match where the link leads. Follow these steps:

1. Hover over the ad link (on desktop) or long-press it (on mobile). Look at the actual URL shown in the status bar or pop-up. If it does not match the displayed domain, do not click.
2. Copy the link address instead of clicking. Paste it into a text editor and inspect it. Attackers often use URL shorteners or redirect chains - for example, googleads.g.doubleclick.net that then redirects to a phishing site.
3. Search for the site name manually instead of clicking any ad. Type the official domain directly into your browser's address bar. Bookmark the real site if you use it frequently.
4. Use a bookmark you created yourself. Do not rely on browser autocomplete or history, because some phishing sites can inject entries into your browser history via redirects.
5. Check the domain age of the site you are visiting. Phishing domains are usually registered within the last few days or weeks. You can use a WHOIS lookup tool to see the registration date. If the domain is less than 30 days old, treat it as suspicious.

What to do if you clicked a fake sponsored link

If you only visited the page and did not enter any information or connect your wallet, you are likely safe. Close the tab and clear your browser cache. If you typed a password or seed phrase, assume that account is compromised:

• Move any remaining funds to a new wallet with a fresh seed phrase.
• Change passwords on any accounts where you used the same credentials.
• Revoke token approvals on the affected wallet using a token approval checker tool.
• If the site asked for your email, watch for follow-up phishing attempts.

Why Google has not fixed this

Google removes phishing ads when users report them, but the problem persists because of scale and profit. A single successful phishing campaign can steal tens of thousands of dollars, which far exceeds the cost of running the ads. The review process relies on automated checks and human reviewers who may not spot cloaked pages. Attackers also rotate domains and ad accounts quickly, making removal a game of whack-a-mole.

Your best defense is to never click sponsored links for crypto services. Type the URL yourself, use a bookmark, or verify the destination URL in two separate places before you connect a wallet or enter a password.

Back to phishing