Stolen Meta and Google ad accounts are worth more than the money they hold
Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy complete with tiered pricing, escrow services, and money-back warranties for stolen accounts.
Public reporting on this topic tends to focus on drained ad budgets, but according to Mimecast, that’s often a short-lived gain for attackers.
“Both platforms operate on a pre-loaded credit or card-on-file model. Campaigns spend continuously until a budget cap, or the account holder intervenes. A newly compromised account with a $5,000 monthly budget can be drained in hours,” Mimecast explained.
“Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account. This is what makes the older, higher-history account worth a 2 to 4 times premium in the underground market,” they added.
Age, spending history, verification status and daily spending limits determine the price, with Zscaler reporting stolen Meta Business Manager accounts selling for anywhere from around $15 to $340, while some Google Ads accounts for high-risk sectors have been listed for $200 to $270 on Telegram.
A record high, right after the biggest crackdown
The company’s Threat Research Team has tracked 6.4 million detections of Meta Business Manager and Google Ads account theft over four years, and the trend line is not moving in the direction anyone would want.
The second half of 2025 produced approximately 1.86 million detections, a new high above every prior period. That volume came after some of the largest enforcement actions against this ecosystem to date had already concluded. The pattern holds throughout the four-year dataset. Takedowns and arrests produce a dip, then activity returns to equal or higher levels.
Mimecast’s four-year detection telemetry for Meta Business Manager and Google Ads account theft campaigns (Source: Mimecast)
Mimecast ties activity to Vietnam-linked malware families including DuckTail, NodeStealer, VietCredCare, and PXA Stealer, alongside separate operations traced to Brazil and Portugal and to China and Hong Kong.
When the PXA Stealer ring was dismantled in March 2026, with 14 people prosecuted, detection volume dropped for a period before beginning to recover.
How the phishing gets past the filters
Mimecast looked at how these campaigns land in inboxes in the first place, beyond the phishing templates and credential harvesting pages themselves, and found a deliberate pattern of abusing trusted sending infrastructure.
Threat actors have moved away from purpose-built malicious infrastructure and toward legitimate, high-reputation sending platforms that email security tools are configured to trust.
Mimecast’s telemetry shows that among these campaigns, about one in three detections arrived through Salesforce infrastructure, with another quarter delivered through Google Workspace mail-merge tools and SharePoint-hosted links.
“This distribution is not accidental,” researchers noted. “Salesforce and Google carry established sender reputations that bypass reputation-based filtering. Delivery through these platforms means the sending IP, domain, and authentication records (SPF, DKIM) all pass checks that would reject an unknown domain. The attacker’s only task is to make the content convincing.”
Losing the account costs more than losing the budget
Fraudulent ad spend can typically be shut down within hours, once a business notices unfamiliar campaigns and cancels the linked payment method. Getting the account itself back takes much longer.
Attackers who gain access often add their own admins and downgrade the legitimate owner to a limited role, something platform permission structures don’t always let a newly added admin reverse. Reclaiming ownership and rebuilding standing with the platform’s review systems can take months, all while the account may still be locked in appeal queues.
“Unlike card fraud, where chargeback and zero-liability protections exist, platforms offer no equivalent, and have a structural financial incentive not to act quickly,” the researchers said.
Platforms still profit
When a compromised ad account keeps running campaigns, the platform earns revenue on every impression served, whether the advertiser is the legitimate owner or an attacker spending stolen budget.
A 2026 class-action complaint from the Consumer Federation of America cites Meta’s own estimates putting scam advertising at 15 billion impressions a day, worth an annualized $7 billion in revenue, and alleges Meta prioritized that revenue over user safety.
Meta has taken some enforcement steps of its own, suing scam advertisers in February 2026 and working with law enforcement on Southeast Asian criminal networks the next month.
The incentive stays in place regardless, an account under review can keep serving ads while the review plays out. Malwarebytes documented one advertiser that stayed active after 30 reports.
“Until advertisers manage administrative access, partner relationships, and account activity with the same rigor applied to other high-value digital assets, and
platforms provide recovery processes that reflect the value of these accounts, compromised advertising accounts will continue to circulate within the criminal ecosystem,” Mimecast concluded.