$ cat Malvertising & Malicious Search Ads

Malvertising (malicious advertising) is the use of online ads to deliver malware, steal credentials or run scams. On search engines it is the paid twin of SEO poisoning: instead of ranking a malicious page organically, the attacker buys an ad that sits above the real result, often using the brand's own name. This chapter explains what malvertising is, how a malvertising attack works, documented examples, and what users and brands can do about it.

1 · What is malvertising?

Malvertising means using legitimate ad networks to put malicious content in front of people. The ad might link to a fake download page, a phishing login, a tech-support scam or an exploit, and it can appear on search engines, news sites, social feeds and pirate streaming sites. Because the ad is served by a real network, it borrows the trust of the site it appears on. [1] [2] confirmed

So is malvertising a type of phishing? It is a delivery channel that is often used for phishing, but also for malware that never asks for a password. interpretation

2 · How a malvertising attack works

1. Buy or hijack an ad account. New accounts, stolen advertiser accounts or reseller accounts with a clean history.
2. Target high-intent searches. "Download [popular app]", crypto wallets, banking logins, password managers, remote-access tools.
3. Show the reviewer something clean. The landing page serves a harmless decoy to ad-review systems and researchers, filtered by IP, location, time or referrer. This is the same cloaking described in the search manipulation chapter.
4. Redirect real victims. A chain of redirects leads to a lookalike site with a believable domain.
5. Deliver the payload. A signed-looking installer that bundles the real app with an infostealer, remote-access trojan or loader.

The FBI warned in December 2022 that criminals were buying search ads impersonating brands, especially for software downloads and cryptocurrency exchanges, to spread malware and steal logins and funds. [1] confirmed

[{t}] GET /?gclid=… sponsored-click          200  [app]-official.example
!       ip=reviewer-asn  → 200 "Welcome to our blog"  (decoy)
[{t}] 302  Location: https://cdn-track.example/r?id=81f…
[{t}] 302  Location: https://get-[app].example/download
!       ua=Windows  geo=US  ref=google  → 200 "Download [app] 64-bit"
[{t}] GET /files/[app]_setup_x64.msi   12.4 MB  application/x-msi
!       msi → powershell -w hidden → stealer.dll  (wallets, cookies, saved passwords)
# the real [app] installs too. the user never notices.

3 · Malvertising examples

• Brand impersonation in search ads (2022 to now). The FBI's public service announcement described ads that look almost identical to real listings and lead to cloned sites for software and crypto exchanges. [1] confirmed
• Storm-0408 (detected December 2024). Microsoft traced malvertising on illegal streaming sites through a four-to-five-stage redirect chain to payloads hosted on GitHub, and in some cases Discord and Dropbox. It estimated nearly one million devices were affected, with infostealers including Lumma Stealer and Doenerium plus NetSupport RAT. [3] confirmed
• Scale of enforcement. Google reported removing 5.1 billion ads and suspending 39.2 million advertiser accounts in 2024, up from 12.7 million accounts in 2023. Not all of those were malware, but the number shows how many bad advertisers try. [4] confirmed

  ┌─[ Sponsored ]──────────────────────────────── [x] ┐
  │  ★ Official Download ★  Free · Fast · Safe        │   the [x] is part of the ad.
  │  www.[app]-0fficial.example                       │   so is the "Safe".
  │        [  DOWNLOAD NOW  ]   ← 12,481 today        │   so is the counter.
  └───────────────────────────────────────────────────┘

4 · Why malvertising is an SEO problem

Malicious ads sit on the same results page your organic listing does, usually above it, and they target your brand name. If someone searches for your software or service and clicks a lookalike ad, your brand takes the blame. For publishers, a malicious ad served on your pages can get your site flagged by browser warnings. interpretation Monitoring the paid results for your brand terms belongs in the same routine as watching organic rankings. practitioner

5 · Signs of a malicious ad

• The domain in the ad is close but not exact: an extra word, a swapped letter, a zero for an "o". [1]
• A download that should be free asks you to disable antivirus, or arrives as a password-protected archive.
• The site looks right but the URL changes several times after the click.
• A page claims your device is infected and gives a phone number to call.
• Pop-ups or new tabs you didn't open, or browser notifications you don't remember allowing.

6 · How to defend against malvertising

For users, following the FBI's advice: check the ad's URL before clicking, type a known address directly instead of searching for it, and consider an ad blocker. [1] confirmed Keep the browser and operating system updated, and download software only from the vendor's own site or an official app store.

For brands:

• Search your own brand and "download [product]" terms regularly, and check advertisers in Google's Ads Transparency Center. [5]
• Report impersonating ads to the ad platform, and file trademark complaints where they apply.
• Use domain monitoring to catch lookalike registrations early, as the FBI recommends. [1]
• Publish one clear official download location and link to it everywhere, so customers know where the real file lives.
• Protect your own ad accounts with two-factor sign-in; hijacked advertiser accounts are a common source of malicious ads. practitioner

If you were infected: disconnect the device, run a full scan with updated security software, and from a clean device change passwords for email, banking and anything saved in the browser, then turn on two-factor sign-in. Infostealers take saved passwords and session cookies, so signing out of all sessions matters. practitioner

7 · What experts get wrong

"Ads are reviewed, so they're safe." Cloaking shows reviewers a clean page. Review catches a lot, but not everything. confirmed

"Only shady sites serve malicious ads." Search engines and major publishers have served them; that is the point of buying placement on a trusted network. confirmed

"It's an IT problem, not marketing's." Marketing owns the brand terms, the ad accounts and the official download page, which are exactly what attackers imitate. interpretation

Malvertising: common questions

What is malvertising?

Malvertising is the use of online ads, served through legitimate ad networks, to deliver malware or run scams such as fake downloads, phishing logins and tech-support fraud.

Is malvertising a type of phishing?

It is a delivery method that is often used for phishing, but it also delivers malware directly, so the two overlap rather than being the same thing.

What is an example of malvertising?

A search ad for a popular app that leads to a lookalike download page whose installer contains an infostealer. Microsoft's 2025 report on Storm-0408 describes a campaign of this kind that affected nearly one million devices.

How do I avoid malicious ads?

Check the ad's URL before clicking, type known addresses directly, download software only from official sources, and consider an ad blocker.

What is adware in simple terms?

Adware is unwanted software on your device that shows or injects ads. Malvertising is how malicious ads reach you; adware is something that may already be installed.

8 · References

1. Cyber criminals impersonating brands using search engine advertisement services to defraud users. FBI Internet Crime Complaint Center, December 2022. primary
2. Spam policies for Google web search (cloaking, malicious practices). Google Search Central. primary
3. Microsoft warns of malvertising campaign impacting over 1 million devices. The Hacker News, March 2025, reporting Microsoft Threat Intelligence. security press
4. Google Ads suspended 39.2M advertisers in 2024. Search Engine Roundtable, reporting Google's 2024 Ads Safety Report. trade press
5. Ads Transparency Center. Google. primary