---
title: Malicious Google Ads Pushing Fake IP Scanner Software with Hidden Backdoor
description: A new Google malvertising campaign is leveraging a cluster of domains mimicking a legitimate IP scanner software to deliver a previously unknown backdoor dubbed MadMxShell. The threat actor registered multiple look-alike domains using a typosquatting technique and leveraged Google Ads to push these domains to the top of search engine results targeting specific search keywords, thereby
---

[Outsource IT Blog](https://blog.oitc.ca)

# [Malicious Google Ads Pushing Fake IP Scanner Software with Hidden Backdoor](https://blog.oitc.ca/alerts/malicious-google-ads-pushing-fake-ip-scanner-software-with-hidden-backdoor)

 Written by [Nathan Zych](https://blog.oitc.ca/author/nathan-zych) | Apr 26, 2024 2:17:39 PM

A new malvertising campaign has been discovered, using a cluster of domains mimicking a legitimate IP scanner software to deliver a previously unknown backdoor called MadMxShell. The threat actor registered multiple look-alike domains using a typosquatting technique and leveraged Google Ads to push these domains to the top of search engine results targeting specific search keywords. This tactic is designed to attract unsuspecting users and infect their systems with the hidden backdoor.

To learn more about this malicious Google Ads campaign and the fake IP scanner software with a hidden backdoor, read the full article [here](https://thehackernews.com/2024/04/malicious-google-ads-pushing-fake-ip.html).

<https://www.oitc.ca/contact/>

[Click here to contact Outsource IT](https://www.oitc.ca/contact/)

[View full post](https://blog.oitc.ca/alerts/malicious-google-ads-pushing-fake-ip-scanner-software-with-hidden-backdoor)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Nathan Zych"
  },
  "dateModified" : "2025-07-10T22:04:40.698Z",
  "datePublished" : "2024-04-26T14:17:39Z",
  "headline" : "Malicious Google Ads Pushing Fake IP Scanner Software with Hidden Backdoor",
  "image" : {
    "@type" : "ImageObject",
    "height" : 380,
    "url" : "https://341889482.fs1.hubspotusercontent-na3.net/hubfs/341889482/Imported_Blog_Media/malware.png",
    "width" : 728
  },
  "mainEntityOfPage" : "https://blog.oitc.ca/alerts/malicious-google-ads-pushing-fake-ip-scanner-software-with-hidden-backdoor",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Outsource IT Blog"
  }
}
```