Skip to content
Language: EN
EnglishالعربيةРусский中文Tiếng Việt
Start trialDashboard
Start trial

What is malvertising?

Malvertising is malware or fraud delivered through legitimate advertising: a paid ad, or the page it links to, carries a forced redirect, a fake software update, a phishing page or a malicious download. It runs on ordinary sites and search results, and the payload is often shown only to chosen countries, devices and home IP addresses.

Updated

Common forms of malvertising

  • Malicious creatives. Script inside a display ad that sends the whole page to another site without a click, mostly on mobile, or opens pop-unders.
  • Fake download pages. Search ads for popular software that lead to lookalike sites serving an infected installer.
  • Scam landing pages. Fake tech support warnings, fake browser updates, investment schemes with invented celebrity endorsements, and pages that phish bank or wallet logins.
  • Notification traps. Pages that push a browser notification prompt, then use the permission to send scam ads to the device.
  • Exploit delivery. Ad code that probes the browser for an unpatched flaw. Common when browser plug-ins were, rarer now, still aimed at outdated browsers.

How it gets past review

Ad networks scan creatives and landing pages before approval and after. Malvertising works around the scan rather than through it:

  • Cloaking. Reviewers and scanners get a clean page; targets get the payload. See ad cloaking.
  • Delayed activation. The creative or landing page turns malicious days after approval, often by swapping one script or one redirect hop.
  • Narrow targeting. The payload fires only for one country, one device type, first-time visitors or residential IPs, so a scan from anywhere else sees nothing.
  • Compromised accounts. Ads run from hijacked advertiser accounts that have a clean history.
  • Long redirect chains. Several hops through tracking and parked domains, with the payload host changed often.

Malvertising, adware and ad fraud

The three are often confused. Malvertising uses real ad channels to attack the person who sees the ad. Adware is software already on the device that injects or loads ads. Ad fraud takes advertisers' money with fake impressions and clicks, which measurement counts as invalid traffic. Adware that loads ads in the background is both: a device problem for its owner and invalid traffic for the advertiser.

How to check a campaign safely

  1. Work in a disposable environment: a virtual machine or container with a fresh browser profile and no saved logins. Treat every file a check downloads as live malware and do not open it.
  2. Load the publisher page or landing URL through a residential exit in each targeted market, with the device type the campaign targets. Do not click the ad.
  3. Capture the redirect chain with status codes, the final URL, a screenshot, and any download or permission prompt.
  4. Look up each domain in the chain with Google Safe Browsing's site status and a URL scanner such as VirusTotal. Newly registered domains and hops across unrelated top-level domains are warning signs.
  5. Repeat from a datacenter exit. If the payload appears only on the residential route, the campaign is also cloaked.

Report what you find through the report link in Google's Ads Transparency Center or Meta's Ad Library, or to the publisher's ad operations team, with the creative, time, market and redirect chain attached.

Common mistakes

  • Checking on a work laptop. A live payload is aimed at exactly that kind of browser.
  • Checking desktop only. Forced redirects are mostly a mobile problem.
  • Checking one market. A campaign can be clean in the country you check and malicious in the next.
  • Clicking the ad to see where it goes. It bills the advertiser and can trigger the payload on your machine.

Malvertising checks on TrueProxies

Residential IPv4 exits put a check inside the markets a campaign targets, by country and city, or by ASN on Unlimited Bandwidth, Standard and Premium. A rotating session gives each check a fresh exit. Datacenter IPv6 is not built for these checks: it is filtered and cloaked as hosting traffic and cannot load hosts that have no IPv6 address. The ad verification proxies page has the capture fields and evidence templates.

Questions about malvertising

Can you get malware just by viewing an ad?

Rarely today, but it has happened. Exploits delivered through ad code needed an unpatched browser or plug-in; most malvertising now needs a step from the user, such as installing a fake update or typing a password. Keep the browser updated and treat unexpected download and permission prompts as hostile.

Do ad blockers stop malvertising?

They block most ad requests, so they block most malvertising with them. They do not stop a scam page reached through an ordinary link or a lookalike site found in search results.

Who is responsible for removing malvertising?

Ad networks and exchanges scan and remove creatives, and publishers use creative-security tools to block bad ads on their pages. The advertiser account behind the ad is usually fake or hijacked. Report it to both the network and the publisher.

Why does a malicious ad only appear in some countries?

Attackers target the countries where a scam pays and keep the payload away from the places reviewers check from. That is why a check needs an exit inside each targeted market.