Malicious Advertising

How malicious advertising works

Malicious advertising, often called malvertising, abuses legitimate ad delivery chains to turn a trusted distribution channel into an attack path. The ad itself may be malicious, the landing page may be poisoned, or the advertiser account may already be compromised. The danger is that users can be redirected from ordinary browsing to malware or phishing without any obviously suspicious site visit.

This makes the threat especially effective because it hides inside normal ad ecosystems, where users, browsers, and security teams expect large volumes of third-party content. The attack does not need a victim to choose a risky website; it only needs the ad or redirect path to execute first.

Where the exposure comes from

Exposure usually begins in one of three places: compromised ad accounts, compromised ad exchanges or ad-tech infrastructure, or a poisoned destination page. In each case, the attacker is exploiting trust that already exists in the advertising supply chain. The ad platform may be legitimate, but the content or redirection path has been altered to serve harmful payloads or credential theft pages.

That trust boundary matters because ad delivery often crosses multiple intermediaries, including creatives, trackers, redirectors, and landing pages. The more hops involved, the harder it is for a single organisation to see the full chain end to end.

Why malicious advertising is dangerous

Malvertising is dangerous because it combines scale, legitimacy, and user intent confusion. A single poisoned campaign can reach many users quickly, and the content may appear inside a reputable publisher or platform that people do not normally distrust. It can also be used as an initial access route for ransomware, stealers, or phishing kits.

The practical consequence is not just browser compromise. Malicious ads can steal credentials, drop malware, harvest sessions, or send users to lookalike login pages where token and password theft becomes possible before defenders realise the traffic was hostile.

How organisations reduce and detect the risk

Defence starts with ad-supply visibility: know which ad networks, exchanges, scripts, and redirect domains are present on your properties, and review them as part of web security governance. Security teams should treat ad-tech as an external dependency that can fail even when the core site is sound. Detection should look for unusual redirects, suspicious script injection, unexpected login prompts, and bursts of traffic to newly observed domains.

Browser isolation, script controls, ad-blocking where policy allows, and strong web filtering can reduce exposure, but they do not eliminate the need to inspect publisher-side compromises and campaign abuse. When a malvertising incident is suspected, investigate the ad tags, the redirect chain, and any user accounts or credentials entered after the click.

Risk and Threat Considerations

Malicious advertising is risky because it turns a normal trust relationship into an attack path at internet scale. Even one compromised ad account or poisoned redirect can create broad exposure across many users and publishers, while the attacker benefits from familiar branding and routine browser behaviour.

Failure mechanism: The attacker abuses a legitimate ad delivery path, then uses redirects or injected content to deliver malware, phishing pages, or credential-harvesting flows before the user can identify the source as hostile.

Impact: Organisations can see account compromise, malware infection, session theft, fraudulent logins, and incident spread across users who never intentionally visited a malicious site.

Practitioner Guidance

Why practitioners should care: Malvertising is not just a consumer nuisance, it is a front door into enterprise risk when employees, contractors, or customers browse from trusted environments. Treat ad-tech as part of the attack surface, especially on high-traffic properties and login-adjacent pages.

What to watch for: Investigate unexpected redirects, ad-script changes, suspicious landing domains, and authentication attempts that follow ad clicks. If a campaign has already led to credential entry or malware execution, review affected accounts, revoke active sessions where appropriate, and consider whether downstream secrets or tokens were exposed.

Related resources from NHI Mgmt Group

• What are the signs that a macOS infection came from malicious advertising or a trojanized application?
• How should teams reduce risk from malicious npm package installs?
• Why do malicious OAuth applications bypass so many IAM controls?
• How should teams slow down malicious dependency updates without breaking delivery?