What is Malvertising?

Malvertising, or “malicious advertising,” is the use of online advertising to distribute malware with little to no user interaction required.


Award-winning ThreatDown EDR stops threats that others miss

Talk to an expert

Malvertising: The Deceptive Ads Lurking Online

In the vast expanse of the internet, where information and entertainment flow freely, advertisements serve as the lifeblood for many websites. However, this seemingly harmless exchange can harbor a hidden threat: malvertising. Malvertising, a sinister portmanteau of “malicious” and “advertising,” refers to the practice of injecting malicious code into seemingly legitimate online advertisements. These infected ads then infiltrate unsuspecting users’ devices, potentially wreaking havoc on their data and security.

This deceptive tactic exploits the inherent trust users place in established websites. When a user encounters an ad displayed on a reputable news platform or a popular retail site, they’re less likely to suspect malicious intent. Cybercriminals capitalize on this trust by meticulously crafting ads that appear genuine, seamlessly blending into the website’s design. These ads can take various forms, from eye-catching banner ads to seemingly innocuous video content.

How Does Malvertising Work?

Malvertising attacks unfold in a meticulously crafted sequence. Here’s a breakdown of the typical process:

  1. Compromised Systems: The initial stage often involves compromising legitimate advertising networks or the servers of individual websites. Cybercriminals may exploit security vulnerabilities or employ social engineering tactics to gain access. Once inside, they inject malicious code into the ad delivery system.
  2. Infected Ads: With access secured, the attackers craft and upload malicious advertisements. These ads often mimic legitimate offerings, featuring familiar logos, popular products, or enticing deals. The malicious code can be embedded within the ad’s image, script, or even within seemingly harmless elements like a “download” button.
  3. Distribution on Websites: The infected ads then enter the online advertising ecosystem. Attackers may exploit weaknesses in ad verification processes or target smaller, less secure networks to distribute their malicious content. Unaware website owners unknowingly display these infected ads alongside legitimate ones.
  4. User Interaction: When a user visits a website displaying a malvertising ad, several scenarios can unfold. In some cases, simply viewing the ad can trigger the malicious code. This technique, known as drive-by download, leverages vulnerabilities in the user’s software to silently download malware onto their device. Other times, clicking on the ad or interacting with its elements initiates the infection process.
  5. Payload Delivery: Once triggered, the malicious code delivers its payload. This payload can vary depending on the attacker’s goals. Common payloads include:
    • Malware: This can encompass a wide range of malicious software, including ransomware that encrypts user data, keyloggers that steal login credentials, or Trojans that grant remote access to attackers.
    • Redirect Attacks: The user might be redirected to a phishing website designed to steal personal information or financial details.
    • Cryptojacking: The code may hijack the user’s device resources to mine cryptocurrency for the attacker’s benefit.


The Devastating Impact of Malvertising

The consequences of a successful malvertising attack can be severe. Here’s a glimpse into the potential damage:

  • Data Theft: Malvertising can be used to steal sensitive information like login credentials, credit card details, or personal data. This information can be used for identity theft, financial fraud, or further cyberattacks.
  • System Damage: Downloaded malware can damage a user’s device, corrupt files, disrupt operations, or even render it inoperable.
  • Financial Loss: Stolen financial information can lead to unauthorized charges, account takeover, or financial losses for individuals and businesses alike.
  • Privacy Invasion: Malicious software can spy on users’ activities, capture keystrokes, or steal browsing data, leading to a significant loss of privacy.
  • Disruption and Downtime: Malvertising attacks can disrupt website operations, leading to downtime and potential financial losses for website owners.


Protecting Yourself from Malvertising

While malvertising poses a significant threat, there are steps you can take to protect yourself:

  • Ad Blockers: Consider using a reputable ad blocker to prevent malicious ads from loading on websites you visit. However, be aware that some ad blockers may not be completely foolproof.
  • Software Updates: Keeping your operating system, web browser, and security software up to date with the latest patches is crucial. These updates often include fixes for security vulnerabilities that attackers exploit in malvertising campaigns.
  • Healthy Skepticism: Be wary of ads that seem too good to be true or create a sense of urgency. Avoid clicking on suspicious ads, especially those with misleading offers or grammatical errors.
  • Hover Before You Click: Before clicking on any ad, hover your mouse over the link to see the actual destination URL in the browser’s status bar. If the URL seems suspicious or doesn’t match, avoid clicking on the ad.

Featured Resources

Frequently Asked Questions (FAQ) about Malvertising

What is malvertising and how does it work?

Malvertising, short for malicious advertising, is a sneaky way cybercriminals infect your device with malware through online ads. Attackers hide malicious code within seemingly normal ads displayed on legitimate websites. When you visit an infected website, the code can try to infect your device without you even clicking on the ad.

Malvertising works in a few steps: first, attackers compromise advertising networks or websites to inject the malicious code. Then, they design fake ads that look real, often featuring popular logos or enticing deals. These infected ads are then distributed across websites, and unsuspecting users who view or click on them risk malware infection. The malware can steal your data, damage your device, or even redirect you to scam websites.

How can malvertising harm me?

Malvertising poses a significant threat to your data security and device functionality. Here’s how it can impact you:

  • Data Theft: Malicious code can steal your login credentials, credit card details, or personal information. This stolen information can be used for identity theft, financial fraud, or further cyberattacks.
  • Malware Infection: Downloaded malware can damage your device, corrupt files, disrupt operations, or even render it unusable. This can lead to data loss, productivity disruptions, and potential repair costs.
  • Privacy Invasion: Malicious software might spy on your activities, capture keystrokes, or steal browsing data, compromising your online privacy.
  • Financial Loss: Stolen financial information can lead to unauthorized charges on your accounts or even complete account takeover.

How can I protect myself from malvertising?

While malvertising can be a challenge, there are steps you can take to minimize the risk:

  • Use Ad Blockers: Consider installing a reputable ad blocker to prevent malicious ads from loading on websites you visit. However, keep in mind that ad blockers may not be foolproof and some legitimate ads might also be blocked.
  • Practice Safe Browsing: Be cautious of ads that seem too good to be true or create a sense of urgency. Avoid clicking on suspicious ads, especially those with misleading offers, grammatical errors, or unfamiliar logos.
  • Hover Before You Click: Get into the habit of hovering your mouse over an ad before clicking. This will reveal the actual destination URL in the browser’s status bar. If the URL seems suspicious or doesn’t match the advertised content, avoid clicking on it.
  • Software Updates: Always keep your operating system, web browser, and security software updated with the latest patches. These updates often include fixes for security vulnerabilities that attackers exploit in malvertising campaigns.