Google Ads MMC Sync Phishing Campaign Uses Fake Maintenance Notices for Credential Theft
Google Ads MMC Sync Phishing Campaign Uses Fake Maintenance (TL-2026-2535), also tracked as Click to Sync Campaign, is a medium-severity phishing campaign, first published 2026-07-21. It has no confirmed attribution, affects Google Google Ads Manager Account (MCC/MMC) - account holders and, maps to 12 MITRE ATT&CK techniques (T1036.005, T1056.003, T1078), and is covered by 9 detection rules and 8 indicators of compromise.
Key facts for TL-2026-2535
- Threat ID
- TL-2026-2535
- Also known as
- Click to Sync Campaign
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-21
- Last reviewed
- 2026-07-21
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- advertising, marketing, digital marketing agencies, ecommerce
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Cofense's Phishing Defense Center (PDC) intercepted a phishing campaign spoofing 'Google Ads MMC Sync' maintenance notices that routes victims through a Blogspot-hosted loading page to a lookalike domain (mcc-sync-ads.com) hosting a JavaScript form that mimics the Google sign-in experience to harvest and store Google account credentials.
How Google Ads MMC Sync Phishing Campaign Uses Fake Maintenance works
On 2026-07-21, Cofense's Phishing Defense Center published details of an active phishing campaign impersonating Google Ads Manager Account (MCC/MMC) synchronization maintenance notices. The lure email displays the sender name 'Google Ads MMC Sync' but is actually sent from enavalenceart.com, a domain unrelated to Google, showing the attacker either registered or otherwise obtained sending capability on a domain unconnected to any legitimate Google Ads communication channel. The email content warns that accounts not synchronized within the specified window could experience service interruptions or account limitations, creating urgency, and presents a 'Complete Sync Account' call-to-action button.
Clicking the button routes the victim to an intermediate loading page hosted on Blogspot (a free, Google-owned blogging platform) at syncmcchub.blogspot.com/2026/06/syncmcchub.html. This page displays the Google Ads logo and a loading indicator, using the inherent trust and domain reputation of Blogspot to mask the transition to fully attacker-controlled infrastructure and reduce the odds of the redirect chain being flagged by URL/domain reputation filtering.
The victim is then delivered to the final landing page at mcc-sync-ads.com, a newly registered lookalike domain whose name closely mirrors legitimate Google Ads MCC/sync terminology. This page presents a JavaScript-driven form that visually replicates the Google account sign-in experience -- per Security Boulevard's syndicated writeup, victims who click the embedded 'Sign in with Google' button are shown what appears to be an official Google login popup. Per Cofense PDC, the form 'accepted and stored the victim's credentials' upon submission, completing the credential-harvesting objective; this is a textbook web-portal credential-capture mechanism (input capture via a fake web portal) rather than a browser-injected keylogger or OS-level input hook. Cofense PDC characterizes the campaign's operational tradecraft as a 'trust-building sequence' that rotates multiple senders, sending domains, email subject lines, and landing pages across waves specifically to defeat exact-indicator-match detection.
No CVE or software vulnerability is involved; this is a pure social-engineering / credential-phishing operation targeting organizations for which Google, Microsoft, and Amazon platforms are described as 'a major part of the business process' -- i.e., businesses and agencies that manage Google Ads accounts, including MCC (My Client Center) hierarchies used by agencies to manage multiple advertiser sub-accounts. This targeting profile is consistent with a broader, independently-documented wave of Google Ads MCC-focused credential phishing tracked since at least November 2025 (Search Engine Land, PPC News Feed). Per that reporting, once attackers obtain valid MCC credentials from campaigns in this category, the documented post-compromise pattern is to add fraudulent/rogue administrator users to the compromised MCC (an account-manipulation persistence step), link an attacker-controlled MCC to the victim's account hierarchy to retain access even if the original credential is rotated, and immediately launch high-budget fraudulent ad campaigns -- one agency cited by Search Engine Land reported 'tens of thousands' of dollars in unauthorized ad spend within 24 hours, with fraudulent ads frequently redirecting to further malicious sites. The same reporting notes that even MCC accounts protected by two-factor authentication have been compromised in this campaign category, because the credential-harvesting step captures the password before any authentication challenge is presented, and that support-escalation delays give attackers a multi-day window to keep draining budget. Cofense's July 2026 report does not confirm that this specific downstream monetization occurred in this exact instance -- only that the credential-harvesting form successfully captured and stored submitted credentials -- but the broader campaign category it belongs to is financially motivated account-takeover fraud against advertiser accounts, not espionage.
MITRE ATT&CK techniques used in TL-2026-2535
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Credential Access
Initial Access
T1078 Valid Accounts; T1566.002 Spearphishing Link
Persistence
T1098.003 Additional Cloud Roles
Execution
Resource Development
T1583.001 Domains; T1583.006 Web Services; T1585.002 Email Accounts; T1608.005 Link Target
Impact
stealth
Affected products and versions in Google Ads MMC Sync Phishing Campaign Uses Fake Maintenance
- Google — Google Ads Manager Account (MCC/MMC) - account holders and administrators
Vulnerable versions: N/A - social-engineering/credential-phishing campaign targeting account holders, not a software vulnerability
Fixed in: N/A
Remediation for Google Ads MMC Sync Phishing Campaign Uses Fake Maintenance
Immediate actions
- Block/flag inbound mail from enavalenceart.com at the email gateway.
- Block or sinkhole traffic to mcc-sync-ads.com and add it to web/URL filtering blocklists.
- Block or flag redirects to syncmcchub.blogspot.com/2026/06/syncmcchub.html and monitor for similarly-patterned Blogspot redirect URLs (e.g. path segments containing 'sync', 'mcc', 'ads').
- Force a password reset and session/token revocation for any user who submitted credentials on mcc-sync-ads.com.
- Review Google Ads Manager Account (MCC) admin/user lists for unrecognized accounts added following any suspected credential exposure, and remove dormant/unrecognized users.
- Audit MCC-to-MCC account links for any manager account not recognized by the organization and unlink immediately.
Workarounds
- Instruct Google Ads MCC administrators to always navigate to ads.google.com directly rather than clicking email links for any account maintenance or sync action.
- Restrict who within an organization is permitted to manage MCC linking/admin settings, reducing blast radius if a single account is phished.
- Set daily/campaign budget caps and billing alerts on MCC-managed accounts to limit financial exposure if an account is taken over.
Longer-term hardening
- Deploy email authentication enforcement (SPF/DKIM/DMARC with reject policy) to reduce display-name spoofing efficacy.
- Enforce phishing-resistant MFA (hardware security keys/FIDO2) on all Google Workspace and Google Ads accounts to neutralize password-only credential theft -- password-only 2FA prompts have proven insufficient against this campaign category since the credential is captured pre-authentication.
- Deploy URL/domain reputation and sandboxing at the email gateway that follows multi-hop redirect chains (including through trusted platforms like Blogspot) rather than only checking the first-hop URL.
- Run recurring user-awareness training emphasizing that Google Ads/Workspace never require account 'sync' via emailed links, using this campaign as a training example.
- Establish an internal fast-track escalation path for suspected MCC account compromise to close the multi-day support-response window attackers currently exploit to keep draining ad budget.
Weaknesses (CWE) in Google Ads MMC Sync Phishing Campaign Uses Fake Maintenance
CWE-451
Timeline of Google Ads MMC Sync Phishing Campaign Uses Fake Maintenance
- Search Engine Land reports a surging wave of Google Ads MCC-takeover phishing attacks, documenting the post-compromise pattern (rogue admin addition, MCC linking, high-budget fraudulent ad spend) that this campaign's targeting profile matches.
- PPC News Feed independently reports the same rising wave of MCC phishing attacks against Google Ads agencies and professionals.
- PPC News Feed reports a related phishing pattern using a fake Google Ads 'synchronization error' pretext, the same lure theme later reused in this July 2026 MMC Sync campaign.
- The Blogspot intermediate redirect page (syncmcchub.blogspot.com/2026/06/syncmcchub.html) is staged; the URL path indicates June 2026, though the exact day is not specified by the source.
- Security Boulevard syndicates the Cofense PDC report the same day, widening distribution of the campaign details and detection guidance.
- Cofense publishes 'Click to Sync: From Google Ads Maintenance Notice to Credential Theft,' documenting the campaign's chain, IOCs, and the rotating-indicator evasion tactic.
- Cofense PDC confirms the JavaScript-based fake Google sign-in form hosted on mcc-sync-ads.com accepted and stored submitted victim credentials.
- Analysts confirm the lure's call-to-action routes victims through the Blogspot loading page at syncmcchub.blogspot.com before final delivery to the phishing domain.
- Cofense's Phishing Defense Center intercepts the spoofed 'Google Ads MMC Sync' maintenance-notice lure email, sent from the unrelated domain enavalenceart.com, containing a 'Complete Sync Account' call-to-action.
Sources cited for Google Ads MMC Sync Phishing Campaign Uses Fake Maintenance
- Click to Sync: From Google Ads Maintenance Notice to Credential Theft
- Click to Sync: From Google Ads Maintenance Notice to Credential Theft (Security Boulevard syndication)
- Google Ads MCC takeover attacks are rising - here's how the phishing scams work
- Rising Wave of MCC Phishing Attacks Hits Google Ads
- Phishing Email Claims Google Ads Synchronization Error
More in phishing
- Large-Scale Azure-Hosted Tech Support Scam Campaign Targets Japan (13.38M Emails, 240K+ Relay IPs, 33K+ Disposable Azure Blob Storage Sites)
- Phishing Campaign Impersonates ChatGPT Subscription Billing Alerts to Steal OpenAI Credentials via Google API Open-Redirect and nxcli.io Infrastructure
- Global Fake Parcel Delivery Phishing/Smishing Campaign Steals Card and Bank Details
- Fake myGov 'Secure Message' Phishing Scam Targets Australians with Multi-Step Identity Harvesting Flow
- Revolut Phishing SMS Campaign Follows Social-Engineering Data Breach Exposing 680 Customers' KYC Data
Detection coverage for TL-2026-2535
As of 2026-07-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2535 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.