The 1Campaign platform is a “cybercrime-as-a-service” suite used by attackers to launch malicious Google Ads while bypassing automated security filters.

Key tactics and features of the platform include:

• Advanced Cloaking: The platform uses real-time filtering to redirect visitors based on criteria like geography, ISP, and device characteristics, which makes static URL scanning ineffective.
• Scanner Evasion: It assigns “fraud scores” (0–100) to visitors and automatically blocks those from major cloud providers like Google, Microsoft, and Tencent to keep security researchers away.
• Google Ads Launcher: This built-in tool helps criminals impersonate legitimate brands and bypass Google’s policy limitations to deliver malware and crypto-drainers.
• High Precision: In some cases, the platform filtered out 99.4% of total traffic, allowing only a tiny fraction of “clean” victims to reach the actual malicious payload, which helps the campaign remain undetected for longer.