Return to Answer

The scammers did not manage to inject JS into the search results. That would be a cross-site scripting attack with worse security implications than misleading advertisement.

Rather, this is a deliberate feature of Google AdWords. Customers are permitted to specify a custom display URL for an ad link which can be different from the effective final URL. The idea is to enable redirects through trackers and proxy domains while keeping short and descriptive links. Hovering over an ad will only reveal the display URL in the status bar, not the real destination.

Here an example:

Obviously, Google has strict destination requirements for ad links in place, but scammers do occasionally find ways around the vetting process. At least, Google's policy about "destination mismatches" is pretty clear:

There are some exceptions, though:

The scammers did not manage to inject JS into the search results. That would be a cross-site scripting attack with much different security implications than misleading advertisement.

Rather, the displayed target URL of a Google ad is not reliable and may conceal the actual destination as well as a chain of cross-domain redirects. The scammers possibly compromised a third-party advertiser and hijacked their redirects to lead you to the scam site.

Masking link targets is a deliberate feature of Google AdWords. It is generally possible to specify a custom display URL for an ad link which can be different from the effective final URL. The idea is to enable redirects through trackers and proxy domains while keeping short and descriptive links. Hovering over an ad will only reveal the display URL in the status bar, not the real destination.

Here is an example:

Obviously, Google has strict destination requirements for ad links in place and an ordinary customer won't get their ad approved if they set the link target to a completely different domain. But scammers do occasionally find ways around the vetting process. At least, Google's policy about "destination mismatches" is pretty clear:

Trusted third-party advertisers may be permitted to issue cross-domain redirects, though. Some of the exceptions are listed here, e.g.:

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

The scammers did not manage to inject JS into the search results. That would be a cross-site scripting attack with worse security implications than misleading advertisement.

Rather, this is due to a feature of Google AdWords. Customers are permitted to specify a custom display URL for an ad link which can be different from the effective final URL. The idea is to enable redirects through trackers and proxy domains while keeping short and descriptive links. Hovering over an ad will only reveal the display URL in the status bar, not the real destination.

Here is an example:

• I'm googling "shoes".
• The first ad link displays www.zappos.com/Shoes:

• But when I click on it, I actually get redirected multiple times:

https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChXXXXXXXd-6bXXXXXXXXXXXXkZw&ohost=www.google.com&cid=CAASXXXXXp8Yf-eNaDOrQ&sig=AOD64_3yXXXXXXXXXXXXXYX_t_11UYIw&q=&ved=0aXXXXXXHd-6bUXXXXXXXXXwIJA&adurl=
-- 302 -->
http://pixel.everesttech.net/3374/c?ev_sid=3&ev_ln=shoes&ev_lx=kwd-12666661&ev_crx=79908336500&ev_mt=e&ev_n=g&ev_ltx=&ev_pl=&ev_pos=1t1&ev_dvc=c&ev_dvm=&ev_phy=1026481&ev_loc=&ev_cx=333037340&ev_ax=23140824620&url=http://www.zappos.com/shoes?utm_source=google%26utm_medium=sem_g%26utm_campaign=333037340%26utm_term=kwd-12666661%26utm_content=79908336500%26zap_placement=1t1&gclid=CI3vqXXXXXXXXXXXXXBBA
-- 302 -->
http://www.zappos.com/shoes?gclid=CI3vXXXXXXXXXXXXXMBBA&utm_source=google&utm_medium=sem_g&utm_campaign=333037340&utm_term=kwd-12666661&utm_content=79908336500&zap_placement=1t1

Obviously, Google has strict destination requirements for ad links in place, but scammers do occasionally find ways around the vetting process. At least, Google's policy about "destination mismatches" is pretty clear:

The following is not allowed:

• Ads that don't accurately reflect where the user is being directed [...]

• Redirects from the final URL that take the user to a different domain [...]

There are some exceptions, though:

An example of an allowed redirect is a company, such as an AdWords Authorized Reseller, using proxy pages. [...]

For example:

• Original website: example.com
• Proxy website: example.proxydomain.com

We allow the company to use "example.proxydomain.com" as the final URL, but retain "example.com" as the display URL.

One of the weak spots is that Google doesn't have control over the third-party redirectors (in above example, that's pixel.everesttech.net). After Google has vetted their ads, they could decide to start redirecting to a different different domain without being noticed. Chances are that in your case attackers managed to compromise one of these third-party services and manipulated their redirects.

Also, there have been several press reports about an almost identical scam pattern in the past, e.g. this report about a fraudulent Amazon ad whose display URL spells out amazon.com but redirects to a similar tech support scam.

(It's worth noting that your discovery has also evoked some press covfefe on BleepingComputer and others.)

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

The scammers did not manage to inject JS into the search results. That would be a cross-site scripting attack with worse security implications than misleading advertisement.

Rather, this is a deliberate feature of Google AdWords. Customers are permitted to specify a custom display URL for an ad link which can be different from the effective final URL. The idea is to enable redirects through trackers and proxy domains while keeping short and descriptive links. Hovering over an ad will only reveal the display URL in the status bar, not the real destination.

Here an example:

• I'm searching for "shoes".
• The first ad link displays www.zappos.com/Shoes:

• When I click on it, I actually get redirected multiple times:

https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChXXXXXXXd-6bXXXXXXXXXXXXkZw&ohost=www.google.com&cid=CAASXXXXXp8Yf-eNaDOrQ&sig=AOD64_3yXXXXXXXXXXXXXYX_t_11UYIw&q=&ved=0aXXXXXXHd-6bUXXXXXXXXXwIJA&adurl=
-- 302 -->
http://pixel.everesttech.net/3374/c?ev_sid=3&ev_ln=shoes&ev_lx=kwd-12666661&ev_crx=79908336500&ev_mt=e&ev_n=g&ev_ltx=&ev_pl=&ev_pos=1t1&ev_dvc=c&ev_dvm=&ev_phy=1026481&ev_loc=&ev_cx=333037340&ev_ax=23140824620&url=http://www.zappos.com/shoes?utm_source=google%26utm_medium=sem_g%26utm_campaign=333037340%26utm_term=kwd-12666661%26utm_content=79908336500%26zap_placement=1t1&gclid=CI3vqXXXXXXXXXXXXXBBA
-- 302 -->
http://www.zappos.com/shoes?gclid=CI3vXXXXXXXXXXXXXMBBA&utm_source=google&utm_medium=sem_g&utm_campaign=333037340&utm_term=kwd-12666661&utm_content=79908336500&zap_placement=1t1

Obviously, Google has strict destination requirements for ad links in place, but scammers do occasionally find ways around the vetting process. At least, Google's policy about "destination mismatches" is pretty clear:

The following is not allowed:

• Ads that don't accurately reflect where the user is being directed [...]

• Redirects from the final URL that take the user to a different domain [...]

There are some exceptions, though:

An example of an allowed redirect is a company, such as an AdWords Authorized Reseller, using proxy pages. [...]

For example:

• Original website: example.com
• Proxy website: example.proxydomain.com

We allow the company to use "example.proxydomain.com" as the final URL, but retain "example.com" as the display URL.

One major weak spot is that Google doesn't control the third-party redirectors (in above example, that's pixel.everesttech.net). After Google has vetted and approved their ads, they could simply start redirecting to a different domain without immediately getting noticed by Google. It's possible that, in your case, attackers managed to compromise one of these third-party services and pointed their redirects to the scam site.

In recent months, there have been several press reports about an almost identical scam pattern, e.g. this report about a fraudulent Amazon ad whose display URL spells out amazon.com but redirects to a similar tech support scam.

(By now, your discovery has also been picked up by a few news sites, including BleepingComputer.)

• I'm googling "shoes".
• The first ad link displays www.zappos.com/shoes:

• When I click on it, I get redirected multiple times:

Obviously, Google has strict destination requirements for ad links in place, but scammers occasionally find ways around the vetting process. Their policy about destination mismatches is pretty clear on that:

• Ads that don't accurately reflect where the user is being directed

Examples: Using the display URL "www.google.com" but leading to a landing page with the URL "www.youtube.com"; using the keyword insertion feature in the top-level or second-level domain of your display URL, such as "www.{keyword}.com" [...]

• Redirects from the final URL that take the user to a different domain

   **Example:** The final URL http://example.com redirects to http://example2.com
  

But although Google usually requires display and final URL to be on the same domain, a weak point seem to be cross-domain redirects.

(Source)

So, in the past, there have been several press reports about scams via seemingly legitimate Google ads that appear almost identical to your case, e.g. this report about a fraudulent Amazon ad whose display URL spells out amazon.com but redirects to a tech support scam.

• I'm googling "shoes".
• The first ad link displays www.zappos.com/Shoes:

• But when I click on it, I actually get redirected multiple times:

Obviously, Google has strict destination requirements for ad links in place, but scammers do occasionally find ways around the vetting process. At least, Google's policy about "destination mismatches" is pretty clear:

• Ads that don't accurately reflect where the user is being directed [...]

• Redirects from the final URL that take the user to a different domain [...]

There are some exceptions, though:

One of the weak spots is that Google doesn't have control over the third-party redirectors (in above example, that's pixel.everesttech.net). After Google has vetted their ads, they could decide to start redirecting to a different different domain without being noticed. Chances are that in your case attackers managed to compromise one of these third-party services and manipulated their redirects.

Also, there have been several press reports about an almost identical scam pattern in the past, e.g. this report about a fraudulent Amazon ad whose display URL spells out amazon.com but redirects to a similar tech support scam.

(It's worth noting that your discovery has also evoked some press covfefe on BleepingComputer and others.)