Google served me Malware

A walkthrough of a Google Ads malvertising campaign that leads victims through a multi-stage malware infection chain. Starting from a suspicious sponsored search result for Bing Webmaster Tools, the chain progresses through a compromised WordPress site injecting obfuscated JavaScript, a fake Microsoft login page, a malicious .bat file, multiple PowerShell stages with AES-encrypted payloads, and finally a trojanized TortoiseSVN installer. The final payload uses DLL side-loading via a replaced CRHNDL.dll to deploy WebKratos — a .NET RAT that uses WebSockets for command and control, with capabilities including clipboard monitoring, keyboard hooking, and screen capture. The malware is obfuscated with ConfuserX and linked to a phishing-as-a-service kit.