LibreOffice malvertising campaign (01-20-2026)
- Description: Malicious Google Search ad for LibreOffice
- Severity: Medium
- Reporter: Jérôme Segura
- Reported to Google: 01/20/2026
Google Search Ad
Traffic view
Decoy page
Payload
IOCs
| Decoy wbesite | hxxps[://]libre-office-doc[.]org/ |
| Payload URL | file[://]147[.]45[.]178[.]61@80/file/t10/LibreOffice_25.8.4_Win_x86-64[.]vbs |
| Payload SHA256 | 715330cdb252f972dd073184baef526ade7bf0bdae00eaf3cd51668618c005dd |