Hackers Exploiting Trusted Google Domains to Inject Malicious Scripts

A sophisticated new malvertising scheme has emerged, transforming legitimate e-commerce websites into phishing platforms without the knowledge of site owners or advertisers.

Cybercriminals are exploiting integrations with Google APIs to inject malicious scripts into e-commerce sites using JSONP calls.

These scripts silently redirect unsuspecting shoppers to fraudulent payment pages, tricking them into disclosing credit card details while believing they are transacting with trusted merchants.

Unlike traditional malvertising campaigns that rely on suspicious ads or obvious redirects, this attack weaponizes the legitimacy of high-quality sites and clean ad placements.

Shoppers click on legitimate advertisements and visit real storefronts only to encounter invisible threats operating beneath the surface.

One notable victim was Ray-Ban’s Indian store (india.ray-ban.com), where attackers compromised the site’s backend, transforming a trusted retail destination into an unwitting phishing platform.

GeoEdge researchers identified that this attack gives cybercriminals a double advantage: they hijack the credibility of established brands while leveraging the brands’ own marketing investments to drive traffic to their scams.

Although the current scale of attacks remains relatively small, their persistence is particularly concerning.

The vulnerability was disclosed to Google in November 2024, yet several compromised sites remain active, continuing to expose users to ongoing risk.

The technical foundation of this attack exploits JSONP (JSON with Padding), a technique originally designed to bypass the same-origin policy in browsers.

Attackers abuse JSONP endpoints in trusted Google domains to deliver malicious JavaScript that bypasses Content Security Policy (CSP) protections, as most websites explicitly allow Google’s domains.

Inside the JSONP Exploitation Chain

The attack begins with a typical client-side request that appends a callback parameter to an API request.

When the server responds, it wraps the data in the specified callback function:-

malicious_function({"result": "data"});

This exploitation chain has been observed in numerous compromised e-commerce sites, particularly those using Adobe Commerce and Magento platforms.

Network traffic analysis shows multiple abused requests to Google domains, all containing similar obfuscated JavaScript payloads.

These scripts ultimately redirect users to fake payment pages hosted on domains like montina[.]it and premium[.]vn.

The attack’s sophistication lies in its ability to bypass security measures while maintaining a facade of legitimacy, making traditional detection methods ineffective against this emerging threat.

Equip your SOC team with deep threat analysis for faster response -> Get Extra 𝗦𝗮𝗻𝗱𝗯𝗼𝘅 𝗹𝗶𝗰𝗲𝗻𝘀𝗲𝘀 for Free