Malvertising: when advertising is not just annoying, it's also dangerous

As smartphones have become more popular and internet access has become free, it is common for us to be inundated with advertisements when we visit any website. These are usually harmless advertisements that do nothing more than obstruct our reading or create unnecessary needs. However, there are some ads designed to harm us.

Cybersecurity experts refer to the second tactic as malvertising. This is when criminals insert malicious advertising into online ad networks. These threats can be displayed while browsing a trusted website without our knowledge.

Oliver Buxton is an expert at Avast who describes malvertising as a dynamic risk. “Even though the ads aren’t clickable, sophisticated attacks can still be successful because they use code hidden within tiny images.

Malvertising attacks date back to 2007. Cybercriminals used a vulnerability in Adobe Flash software to install malware on popular sites like MySpace. Since then, the threat has grown: Google alone removed 5.1 billion harmful ads in 2024, blocked ads on over 1.3 billion web pages, and suspended accounts for more than 39 millions advertisers.

Phone operators who aren’t telephone operators

As we have said, the majority of malvertising (up to 81 % during the fourth quarter last year according to a report by AdMonsters), corresponds to forced redirects. A good example is an advertisement that invites us to download the popular free antivirus. When we click on the advert, we’re redirected to another website, designed to look like the official site, and we are then able to download an executable that can access the information of our mobile phones.

Sometimes, the download is hosted in the folder automatically for this purpose without our clicking. Buxton continues, “Tech support scams also are common. Fraudulent ads install malware that hijacks the browser to cause disruptions to the user’s experience. The user is then instructed to call the phone number provided to fix the non-existent problem. Scammers will pose as tech employees to try and get you to make an unnecessary credit card payment.

It is not uncommon to find’scareware,’ which are alarming advertisements that display error messages and invite you to download an application that can fix them in seconds. There are also fake updates that fill your gadgets with spyware. It is important to remember that in these situations, errors and updates of the operating system will always be announced via the windows of the O.S. Never when you open the browser or visit external websites.

Find ‘click to play’ in your browser

The National Institute of Cybersecurity in Spain (INCIBE), in addition to not clicking suspicious ads to combat malvertising recommends updating all devices to the latest security patches, installing and enabling browser plug-ins only that are necessary for daily use, adopting security software that detects viruses, malware, and spyware, updating programs like Java or Adobe directly from their sites, and activating the “click-to play” function available in most web browsers. This will require us to accept any plug in that attempts to launch when visiting a website.

In the context of online advertising, children can be particularly vulnerable. Children may click on fraudulent banners because they’re colorful, while teenagers might fall for false promises of discounts or additional content in their favorite video games. INCIBE encourages parents to disable personalised advertising (in the settings) on social networks, install adblockers and limit usage time. You can also teach them to surf safely by showing them the websites that are safe and free of ads.

If we can see that they close the adverts on their tablet or mobile as soon as they see them, then we have done a good job. We should be careful about the exclamation marks that appear on many of the ads, offers and other opportunities that we read and see online.