What it is
Malvertising is when attackers hide malicious code inside online ads. You don’t have to click a sketchy site - a booby-trapped ad on a legit page can redirect, phish, or install malware through drive-by downloads and pop-ups.
How it works - quick tour
-
Compromised ad networks serve malicious creatives to reputable sites
-
Hidden code redirects you to exploit pages or fake updates
-
Fingerprinting picks targets and avoids security sandboxes
-
Payloads include spyware, ransomware, and credential stealers
Red flags
-
Pop-ups asking to install updates or enable notifications
-
Pages that reopen themselves or trigger multiple redirects
-
Downloads starting without you clicking a clear button
-
Security prompts that look slightly off-brand
If it hits - first moves
-
Close the tab or kill the browser process - don’t click prompts.
-
Run a full anti-malware scan, reboot, then scan again.
-
Clear browser cache and notifications, remove unknown extensions.
-
From a clean device, change passwords and enable MFA if anything seemed phishy.
Prevent it
-
Keep the browser, plugins, and OS updated.
-
Use a reputable ad blocker and DNS/web filtering.
-
Disable or limit browser plug-ins like legacy players.
-
Avoid pirated streams and shady download portals.
-
For orgs: enable network-layer protections and inspect egress traffic.
Malvertising and adware are different
Malvertising is delivered through an advertisement or ad network and can affect a visit without installing a permanent advertising program. Adware runs on the device and repeatedly injects ads or changes browser behavior. One incident can still lead to the other if a deceptive download is installed.
After a suspicious redirect
- Do not download a requested update, extension, or security tool.
- Close the tab, cancel any download, and record the page, time, and visible ad if reporting it.
- Update the browser and remove newly granted notification permissions.
- If a file ran or settings changed, perform a full security scan and review extensions.
An ad blocker can reduce exposure, but patched browsers, download controls, DNS or web filtering, and endpoint protection remain important.