What is Malvertising?

The exploitation of digital advertising to spread malware and circumvent systems in a way that harms users, publishers, and platforms is malvertising. Simple terms: ads that look normal but carry harmful code.

In practice, malvertising means a fraudster buys or injects ad space, and the ad delivers malware to whoever sees it. Each malvertisement looks like a real campaign. The visitor sees an offer for free software or a warning that a virus can be fixed with one click that hides malicious code behind it.

Types of Malvertising and Common Malvertising Examples

There are several types of malvertising, and not all of them need a click:

• Forced redirects: The ad hijacks the browser and sends the visitor to a scam page, like the fake gift card pop-up.
• Drive-by downloads: Simply loading a page with an infected ad can put a visitor at risk. Wikipedia’s malvertising history documents several malvertising examples, including a 2011 Spotify incident and major 2014 campaigns on the DoubleClick and Zedo ad networks.
• Scareware and fake updates: Ads push a bogus antivirus, a fake VPN, or a “required” browser update.
• Malverposting: Fraudsters skip the ad and create fake content that seems legitimate, then install malware when someone clicks a link inside it.
• Crypto-mining and video stuffing: Hidden scripts quietly use the visitor’s device or inflate impressions.

Why Malvertising in Cyber Security Is Hard to Stop

Malvertising in cyber security is a tough problem for three reasons. First, the ads look legitimate. Marketers use AI tools to build campaigns, and fraudsters have the same tools to spoof real brands or produce polished malicious ads and videos. Second, most security warnings focus on suspicious emails and texts. Few people think an ad on a trusted site could be dangerous, and a misspelled domain is easy to miss. Third, the volume is huge. Ads are created and placed automatically, so networks and publishers struggle to review each one. An estimate cited by TAG suggests one in every 100 online ads is malicious. TAG has also warned that weak ad markets can create more opportunity for malvertising, because lower ad rates and extra inventory make it easier for bad actors to get in.

Who a Malvertising Attack Affects

A single malvertising attack can hurt everyone in the chain:

• Consumers risk infected devices and stolen data and lose trust in the site and in online ads generally.
• Publishers face complaints, brand damage, and lost revenue when visitors are redirected away or leave for good.
• Advertisers see legitimate ads run next to suspicious ones, which makes audiences reluctant to engage.

Malvertising isn’t the same as ad fraud. Ad fraud is fake impressions and clicks on legitimate ads, while malvertising is about the ad itself being the weapon. That’s why it’s harder to catch. The two are linked, though. As we explain in our post on sophisticated invalid traffic, malware-driven traffic can show up in your data as SIVT.

How Malvertising Protection Has Evolved

The digital landscape keeps changing, and attackers keep getting more sophisticated. That makes it hard to predict where malicious advertising will come from in the programmatic ad ecosystem. Defenses have gone through three generations, and each one fixed a weakness in the last.

Static Analysis

The first generation of defenses relied on static analysis, usually offline scanning. An advertiser registers creative for a new campaign, and an ad quality tool scans it in an offline environment to confirm it’s legitimate.

The result: Attackers got around it easily. An offline scan doesn’t look anything like a real user’s experience, so malicious ads could pass the check and then change behavior once they went live.

Blocklisting

The next generation was URL blocklisting. Security teams compile the suspicious URLs and domains that bad actors have used, then block them from coming back. Sophisticated ad malware can be written to spot a sandbox testing environment and hold back its payload until it reaches a live site.

The result: Blocklisting is still widely used, but it’s only as good as the list. It’s reactive by design. An attacker has to be caught first, then blocked the next time, so brand-new threats get through.

Environmental Analysis

Protection doesn’t stop at the ad. Once malvertising succeeds, the infected visitor becomes a risk of their own. A compromised device can be hijacked into a bot, run hidden scripts, generate fake clicks and impressions, or submit fraudulent forms, and it does all of this on your site, under the cover of an ordinary-looking session. Publishers need to protect themselves from that user, not just from the ad that infected them.

Environmental analysis does this by evaluating the device, browser, network, and session signals around each visit. It can tell a genuine visitor from a device that has been compromised, automated, or set up to mimic a real user. Static scans and sandboxes never see this, because they check the ad in isolation and have no view of the infected device that ends up on your site. Malware that behaves in a testing environment and misbehaves on a real device has a much harder time hiding when the environment is part of the check.

The result: Publishers are protected from the downstream damage that infected users cause. Because the analysis runs in real time, you can flag and filter suspicious traffic as it arrives instead of discovering it later in a revenue report. That keeps invalid traffic out of your analytics, protects your standing with ad partners who may penalize publishers for tainted traffic, and shields your real visitors from the fallout. It also helps break the cycle that funds malvertising. When infected devices can’t monetize your site, there’s less reason for bad actors to target it in the first place.

Find out how many infected users and fake visitors are inflating your metrics by getting a free traffic quality audit today.