Botnets are being used for Google Adword click fraud, according to security watchers.

The SANS Institute has uncovered evidence that networks of compromised PCs are being used to click on banner ads, generating revenue for unscrupulous publishers.

Pay-per-click schemes such as Google Adsense have programs to detect fraudulent clicks and suspend publishers implicated in click fraud. In an effort to disguise bogus visits, these publishers have begun hiring botnets to slip under the radar of fraud detection programs.

The "bottom line is that the advertiser pays in exchange for a bot visiting him", the SANS Institute reports.

Generating traffic from a small number of machines (numbered in the hundreds) makes the traffic generated from compromised machines look innocuous. In return for helping click fraud scammers keep a low profile, botnet owners rake in a percentage from the scam.

The ruse came to light after security experts in the SANS Institute's Internet Storm Centre investigated malicious software on a hacker's website. Control panels on the site, designed to facilitate the control of compromised machines infected with malware, were left open. This allowed security experts to analyse the actions of the botnet operator behind the site.

"The botnet was 115 bots in size at the early time of the day I was looking at it and most were under 15 clicks each," a handler at SANS Institute reports in a diary entry filed last weekend.

The institute has reported the site and its findings to Google. ®