Malvertising

Malvertising, short for malicious advertising, is a cyberattack technique that uses online advertisements to disseminate malware or facilitate unauthorized code execution. It targets users through legitimate websites that display third-party ads, or through compromised ad networks, publishers, or supply chains. Attackers rely on trust in these ads to bypass user skepticism and traditional security controls.

How it works: Malicious code may be embedded directly in an ad, or loaded via a compromised advertising network or landing page. When the ad is loaded, it can perform drive-by downloads, redirect users to exploit kits, or quietly execute cryptomining scripts. Some campaigns rely on content that appears benign until the user interacts with it.

Common forms include in-banner infections, invisible iframes, and redirect chains that send users to malware hosts without noticeable clues. Sophisticated campaigns may use compromised sites, automated ad marketplaces, or multi-stage payloads to reduce the chance of detection.

Impact and risks: Infected devices can suffer from malware installation, data theft, ransomware, or participation in botnets. Businesses face reputation damage, ad-network blacklisting, and financial losses from remediation and downtime. Users may experience browser instability, performance issues, or unwanted cryptocurrency mining.

Prevention and response: Defense includes keeping software and plugins up to date, employing reputable ad networks, and using ad-blocking or security solutions that inspect ad content. Network-level filters, content security policies, and threat intelligence can block known malvertising domains. Incident response should isolate affected systems and remove malicious ads.