“Zero-Code Cloaking”: Attackers Weaponize Google Search and Hacked .ac.th Domain to Bypass Ad Moderation

Security researchers at ADEX have documented a cloaking technique that requires no cloaking code at all.

Instead of running user-agent detection on attacker-controlled servers, the operators chained together three fully legitimate components a Google search results page, a hacked educational website, and a standard redirect in an evasion strategy designed to bypass Google Ads screening and ad moderation.

Instead of running user-agent detection on attacker-controlled servers, the operators chained together three fully legitimate components a Google search results page, a hacked educational website, and a standard redirect to slip an illegal casino campaign past ad-network review.

The compromised domain, km.chpc.ac.th, belongs to a Thai college and sits in the .ac.th zone reserved for accredited educational institutions. That trust signal is precisely what the attackers were after.

Anatomy of the Redirect Chain

ADEX’s monitoring team noticed that an advertiser’s destination URL did not point to a landing page. It pointed to a Google search query. Breaking down the chain:

1. Ad click → Google search results. The ad’s destination URL loads a Google SERP for a specific query. To any moderator or automated crawler, the destination is a benign Google page.
2. Poisoned #1 result. Attackers had already compromised km.chpc.ac.th and planted a casino-themed page. Because the host domain carries strong institutional authority, hackers manipulate search engine rankings to index the injected page and rank it first for the target query.
3. Trusted click → redirect. A user clicking the top result is bounced to an online casino, a product illegal to advertise in Thailand.

The key evasion property: the malicious hop sits one click removed from the ad’s declared destination, on third-party infrastructure the advertiser does not own.

Traditional ad-verification tooling that resolves and inspects the landing URL sees nothing wrong, because there is nothing wrong with the landing URL.

Why Classic Cloaking Detection Fails Here

Conventional cloaking depends on server-side logic: inspect the visitor, decide whether it is Googlebot, a moderator’s headless browser, or a human, then serve different content accordingly.

Detection strategies are built around that fingerprint spoofing, IP rotation, and behavioral crawling that tries to look human.

None of that applies to this campaign. There is no fork in the code path. Every visitor, human or bot, receives the same Google page, the same college page, and the same redirect.

The differential is not in what is served but in how far the reviewer follows the chain. As ADEX put it, “Only the combination created the violation.”

Same Playbook, Global Scale

The Thai college is not an isolated compromise. ADEX cites public data indicating the underlying technique where attackers compromise thousands of websites to inject malicious redirects and gambling spam into high-authority public and academic domains has become industrialized:

Most of the injected content in the Indonesian data is hidden from human visitors via CSS while remaining fully readable to crawlers.

ADEX notes this is mechanically the same trick found on the Thai site, implemented through markup instead of a redirect.

The Policy Gap

Google’s “site reputation abuse” spam policy (introduced March 2024, tightened November 2024 to remove the “owner wasn’t involved” exemption) targets publishers that knowingly rent out their ranking to third-party content.

A hacked college is a victim, not a participant, so the policy offers little practical coverage for this class of abuse.

Detection and Mitigation Guidance

ADEX’s recommendations for ad networks, advertisers, and verification vendors:

• Treat restricted TLD zones as a flag, not a pass. When .ac., .gov, .edu, .mi., or .go.* appear anywhere in a redirect chain, escalate scrutiny. Do not auto-block; the campaign may be legitimate, but do not auto-approve either.
• Follow the chain to the terminal destination. Inspecting only the declared landing page is insufficient when the landing page itself is compliant. “Whatever is malicious sits behind it,” ADEX said, noting that malvertising campaigns frequently exploit multi-hop traffic distribution systemsthat evade standard crawler scans.
• Re-verify post-approval. A redirect chain can be rewired at any point after a campaign passes review.
• Do not trust TLS as a legitimacy signal. A valid certificate proves nothing about the content or the redirect behind it.

For site owners, particularly in academic and public-sector environments:

• Inventory forgotten subdomains. Abandoned DNS records can quickly lead to subdomain takeover attacks and unauthorized reputation hijacking, lending the parent domain’s authority to threat actors.
• Search your own domain like an attacker would. Use site: queries combined with gambling, casino, and adult keywords in local languages. Injected pages are built to be invisible to normal navigation but fully visible to search engines.

ADEX frames the trend as an escalation rather than a novelty: “The domain as a trust signal stopped working long before this, back when malware started being distributed through the CDNs of major players.”

Where attackers once relied on obscure or semi-abandoned domains, the shift is now toward higher-profile, more trusted targets.

ADEX is the AI-driven anti-fraud and traffic-quality platform within AdTech Holding.