Malvertising.

What is malvertising?

Malvertising is the use of online adverts to deliver malicious activity. CISA, the US cyber defense agency, describes it as the use of malicious or hijacked website advertisements to spread malware. Malware is software built to cause harm.

How does malvertising work?

CISA says malvertising inserts malicious ads into legitimate ad networks. It also says these ads bypass built-in browser protections against pop-ups and forced redirects. The ads then spawn a forced redirect or load a payload for malicious purposes. A payload is the harmful code that is delivered.

The UK National Cyber Security Centre (NCSC) says this activity often does not require any user interaction. CISA adds that criminals can craft and tailor malicious ads for a targeted campaign against a specific victim, not only for broad attacks.

What is an example of malvertising?

The FBI Internet Crime Complaint Center (IC3) described one form in a 2022 public service announcement. It says cyber criminals use search engine advertisement services to impersonate brands. They direct users to malicious sites.

The FBI says criminals buy ads that appear prominently in search results, using domain names that resemble legitimate businesses. The ads link to a page that looks identical to the impersonated business’s official page. When the target is a software download, criminals host malware disguised as a legitimate program. They can also impersonate financial platforms to harvest login credentials.

How can you reduce the risk of malvertising?

The FBI gives these tips to individuals:

• Check the URL before clicking an advertisement, to make sure the site is authentic.
• Type a business’s URL into the browser address bar instead of searching for it.
• Use an ad blocking extension when searching the internet.

For businesses, the FBI suggests domain protection services. It also suggests teaching users about spoofed websites and URL checks, and telling them where legitimate program downloads are found.

CISA recommends four actions for federal agencies: standardize and secure web browsers, deploy advertisement blocking software, isolate web browsers from operating systems, and implement protective Domain Name System technologies. The NCSC recommends a defense-in-depth approach and says brands should evaluate advertising partners using its security principles.

How does malvertising relate to phishing and brand impersonation?

Phishing is a trick that persuades people to give up information or run harmful files. Brand impersonation is pretending to be a known company. The FBI example above combines a paid ad with a copied brand. Related terms are phishing, social-engineering and brand-impersonation.

Is malvertising the same as an ad that is only annoying?

No. Malvertising is defined by malicious intent, such as a forced redirect or a harmful payload.

Does the user have to click the ad?

Not always. The NCSC says malvertising often does not require any user interaction.

Can a legitimate website show a malicious ad?

CISA says malvertising inserts malicious ads into legitimate ad networks. The NCSC says one malicious ad can reach many publishers and websites at the same time.

Brandefense monitors lookalike domains and abuse of a brand name online.