Malvertising places harmful ads in ordinary advertising networks so visitors can be led to unsafe pages without seeking them.
The person did not have to click a suspicious mail, because the harmful content arrived in a slot the site rented to an ad network.
How it works
Attackers buy impressions, compromise an ad creative, or abuse a redirect chain so a normal article page loads an unsafe script or an install prompt.
The site owner may be honest and still deliver the harm, which makes the trust problem different from a page the attacker fully controls.
Users see fake software updates, drive by pages, or redirects that try to steal a login after they only meant to read the news.
Publishers and networks reduce the risk by reviewing creatives, limiting redirects, and watching for sudden spikes in bad landing pages.
Concrete examples
- A news article shows a banner that redirects readers to a fake browser update urging them to install an unknown program.
- An ad network serves a creative that loads a script from a newly registered domain for a few hours, then the creative is pulled.
- A streaming site's ad slot sends mobile visitors to a page that asks for a one time code meant for their bank.
Protective measures
- Review ad creatives and redirect chains, and set a maximum number of hops you will allow.
- Block known bad landing domains and alert when a creative's destination changes suddenly.
- Separate advertising scripts from the core site so a bad creative has less access to your users' sessions.
- Give readers a report path for suspicious ads and act on those reports the same day.