What malvertising is

Malvertising (short for “malicious advertising”) is the use of online ads to deliver or enable harmful outcomes—most commonly malware, phishing, or scams. Instead of attacking users directly through an exploit-heavy landing page from the start, the attacker leverages the ad supply chain to get the user to a suspicious destination.

In practice, malvertising can show up on legitimate sites and within normal ad placements. The ad creative (what you see), the landing page (what you reach), or the redirect chain (how you get there) may all be part of the malicious path.

How malvertising typically works

While details vary, many malvertising campaigns follow a similar logic:

  1. The ad is served through an advertising ecosystem. The user sees a seemingly normal ad message and decides whether to click or interact.

  2. Clicking (or sometimes merely loading) triggers a harmful path. That path may include redirects to lookalike domains, pages that prompt deceptive downloads, or scripts that attempt to exploit browser or plugin weaknesses.

  3. The harm can be immediate or staged. Some attacks aim for “drive-by” execution (harmful actions triggered during the visit), while others rely on the user to download or approve something.

Because redirects and scripts are often involved, two users may see different landing behavior depending on timing, geolocation, browser type, or other factors. That variability is one reason malvertising can be hard to spot in advance.

Limitations and why it’s hard to eliminate entirely

It’s important to recognize what malvertising protections can’t guarantee:

  • Malvertising changes quickly. Attackers can rotate domains, creatives, and redirect chains, so static allowlists and one-time filtering may fall behind.
  • Not every harmful ad is detectable just by appearance. Scams may mimic common offers, and “safe-looking” layouts can still lead to harmful destinations.
  • Browser defenses are not universal coverage. Even with protections enabled, gaps can remain due to new exploit techniques, configuration differences, or user interactions.

So rather than treating malvertising as a single problem with a single fix, it’s best treated as a threat pattern that requires layered checking and good hygiene.

Practical checks you can do

When you encounter an ad that seems suspicious, focus on evidence you can verify before taking a risky action:

  • Check the destination carefully. Look for the actual domain in the address bar before entering credentials or downloading anything. Watch for subtle misspellings or “extra” subdomains.
  • Be cautious with redirects. If clicking leads to a sudden chain of unrelated sites, unexpected domains, or repeated back-and-forth pages, treat it as a red flag.
  • Avoid interactions that feel like consent traps. Be skeptical of prompts that ask you to “enable notifications,” “update,” or “install” urgently—especially if the request is inconsistent with the site you expected.
  • Verify downloads and file sources. Only download from sources you trust, and scan files with reputable security tools.
  • Keep your system and browser up to date. Many malvertising outcomes depend on the attacker finding a weakness that patching would remove.

Related concept: If the main goal is credential theft or fraudulent payments, malvertising overlaps with phishing-style behavior. If the harm is delivered as malicious email attachments, that’s closer to malspam than advertising, though the end effect can be similar.

Malvertising is an umbrella pattern, but it’s useful to distinguish it from adjacent threats:

  • Phishing ads: malicious ads that primarily aim to capture credentials or payment data through deceptive forms or lookalike login pages.
  • Tech-support scams: ads that pressure users to contact “support” or install remote access tools via scare tactics.
  • Drive-by exploitation: attacks where the visit triggers the malicious behavior without a deliberate download.
  • Malspam: malicious email used to deliver links or attachments; the initial delivery channel differs, but the objective may overlap.

Knowing which behavior you’re seeing helps you choose safer next steps—for example, whether you should treat it as a credential-harvesting attempt (avoid entering data) or a download prompt (avoid installation and scan any files).