Malvertising exploiting Google search results has been leveraged to lure victims into downloading fraudulent software installers, including YouTube downloader, Roblox FPS Unlocker, and VLC video player, which run a PowerShell script enabling payload retrieval and execution, as well as forces installation of extensions, all of which have since been removed from the Chrome and Edge stores, according to a report from ReasonLabs. Such extensions have been used to enable search query takeovers and redirections to revenue-generating pages, as well as allow login credential theft, online activity tracking, and command execution.

Source: SC Magazine