Malvertising

MITRE T1583.008 covers attackers buying ads to spread malware. The ads can spoof well-known brands. Crawlers can get clean pages while people get malicious ones.

Ads are often the first hop of malicious redirects.

1. An attacker buys ads or abuses an ad network.
2. The ad copies a brand you are searching for.
3. A click passes through redirects to a fake site.
4. The site offers malware dressed as the real download.
5. Some ads lead straight to drive-by exploit pages.

Google's 2025 Ads Safety Report gives the scale. Google blocked or removed over 8.3 billion ads that year. It suspended 24.9 million advertiser accounts. Scams accounted for 602 million of those ads. The figures cover Google's ad platforms only.

The FBI's December 2022 warning described search ads impersonating brands. The fake download pages served malware named after real programs. Microsoft tied Lumma Stealer to search ads for software.

See malicious downloads for file warning signs.

1. Skip the ad and type the vendor's address.
2. Check the address before you download anything.
3. Prefer the vendor's own download page or app store.
4. Consider an ad-blocking extension, as the FBI suggests.
5. Ran a file from an ad? Disconnect and scan the device.

• A domain can be clean yesterday and malicious today.
• Malicious ads appear on reputable sites.
• Cloaking shows reviewers and scanners a clean page.
• Ad networks review ads, but some still get through.

• Publish official download links for approved software.
• Block software installs from unknown sources.
• Filter known malicious ad domains at the DNS layer.
• Capture the full redirect chain when an ad causes harm.
• Teach staff to type addresses for downloads.
• Report malicious ads to the platform that served them.