Latest posts of: 12000suns

What happened::
There is high quality forged Google ad, impersonating coinmarketcap.com (see screenshot below)

After inspection we are unable to determine the mechanism but the following was observed:

URL is exactly the same. No homoglyphs, no mixed alphabets, it hashes the same with the legit string.
The excerpt from source:

Code:

<a style="display:none" href="/aclk?sa=L&amp;ai=DChcSEwi8oK7ejsLZAhVZibIKHQHCBHAYABABGgJscg&amp;sig=AOD64_0ZJhvOZ-0Nf2kK_QgC2W8ewzFjKw&amp;q=&amp;ved=0ahUKEwi64KjejsLZAhVFhiwKHQCbBLUQ0QwIKA&amp;adurl=" id="n1s0p2c0"></a>
<a class="_Jwu r-ieTJdWpaBQ8I" href="https://coinmarketcap.com/" id="vn1s0p2c0" onmousedown="return google.arwt(this)" ontouchstart="return google.arwt(this)" data-preconnect-urls="http://monkey-tracker.info/" jsl="$t t-zxXzjt1d4B0;$x 0;">Cryptocurrency Market Capitalizations | CoinMarketCap‎</a>

shows replaced data-preconnect-urls argument which is used for redirection to whatever the attacker needs.
Currently it redirects to https://thebitcoincode.com/, but as you can imagine same technique can be used in numerous phishing attempts.

If anyone has explanation how they did it, please submit a bug report @ Google

Disclaimer:
Reproduced on different machines with different browsers.
Unable to reproduce with another google account.

Reference screenshot:
https://imgur.com/a/t63y0

Additional Notes:
The domain is privacy protected and is linked to vps hosted in Moscow.