Security researchers at Cisco have released new information about a bitcoin phishing scam that involves websites masquerading as Blockchain.info, the popular online wallet service.

In a blog post published Wednesday, Dave Maynor and Jeremiah O’Connor detailed the Coinhoarder phishing scam, which they said Cisco has been investigating in the past six months in partnership with the Ukrainian Cyberpolice. All in all, they said that those behind the scam had netted $50 million in cryptocurrency over a three-year period.

“The campaign was very simple and after initial setup the attackers needed only to continue purchasing Google AdWords to ensure a steady stream of victims,” they wrote. “This campaign targeted specific geographic regions and allowed the attackers to amass millions in revenue through the theft of cryptocurrency from victims. This campaign demonstrates just how lucrative these sorts of malicious attacks can be for cybercriminals.”

As shown in the blog, those behind the attack would create websites similar to Blockchain but with different domain names – “block-clain.info” and “blockchien.info” among them – that the casual user may not notice. They then “leveraged Google Adwords to poison user search results in order to steal users’ wallets,” thereby directing more traffic to those pages.

Cisco traced the group’s activity back to as early as 2015 and estimated that “tens of millions of dollars” in cryptocurrency had been stolen since that year. They indicated that as much as $50 million had been stolen, including $2 million in less than 4 weeks during one period last year.

“What is clear from the COINHOARDER campaign is that cryptocurrency phishing via Google Adwords is a lucrative attack on users worldwide,” the firm concluded.

Image via Shutterstock