How do fake CAPTCHA campaigns deliver malware?

Fake CAPTCHA pages instruct users to perform steps like opening a system utility and pasting a command. On Windows this may use the Run dialog, while macOS users may be sent to Terminal. Executing the steps can install an infostealer that harvests passwords and crypto wallet data.

How can ad blocking software reduce malvertising risk?

Ad blockers prevent advertisements from loading on web pages, which cuts off a common delivery path for malicious ads. Some tools also block known malicious domains and unwanted scripts. They should be used alongside other security measures rather than as a sole defense.

What was the Trapdoor Android malvertising operation?

Trapdoor was a campaign using 455 malicious Android apps and 183 attacker controlled HTML5 domains to generate ad fraud. The apps were downloaded over 24 million times and peaked at 480 million ad bid requests per day. Google removed the identified apps from Play Store after discovery.

How Malvertising Is Becoming a Major Gateway for Malware

Q: What is malvertising?

Malvertising is a cyberattack technique that hides malicious code within online advertisements. These ads often pass through legitimate ad networks, making them hard to spot for users and publishers. The malicious content can expose many visitors to malware without obvious signs.

Q: What are drive-by downloads in malvertising?

Drive-by downloads occur when malware is installed after a user visits a compromised site or interacts with a malicious ad. Attackers exploit vulnerabilities in browsers, plugins, or operating systems to run code silently. The user does not need to explicitly approve the install for the device to be infected.

Businesses rely heavily on online advertising to reach customers, promote products, and drive traffic to their websites and services. However, cybercriminals are now abusing this same channel to spread malware. Malvertising is one of the techniques cybercriminals are using. In this article, we’ll explore malvertising in detail, including what it is, how it works, common attack techniques, and what users can do to protect themselves.

What Is Malvertising?

Malvertising, short for malicious advertising, is a cyberattack technique that hides malicious code within online advertisements. These infected ads can be difficult for both users and website publishers to identify because they are often distributed through legitimate advertising networks. Since advertisements are displayed to a large number of website visitors, malicious ads may expose many users to malware and other online threats.

How Malvertising Works

1. Obtaining advertising space

The attacker either purchases advertising space or compromises an existing advertiser account that has a trusted history.

2. Bypassing ad security checks

The malicious advertisement is initially designed to appear harmless so that it can pass automated security and moderation checks. Once the ad is approved and published, the attacker can inject malicious code.

3. Delivering the malicious ad

The advertisement is distributed across real, high-traffic websites through advertising networks and real-time bidding systems. This allows the malicious content to reach a large number of people.

4. Launching the attack

When a user clicks on a malicious advertisement, they may unknowingly trigger the delivery of malware to their device. Malvertising can also be used to deliver an exploit kit, a collection of tools to identify weaknesses in a victim’s device. When a user visits a malicious webpage, the exploit kit can examine the browser, operating system, or installed applications for known security flaws. If it finds a vulnerable component, it may attempt to exploit it and deliver malware without the user realizing that an attack is taking place.

Why Malvertising Is Becoming More Dangerous

The growth of malvertising has been partly enabled by the large amount of data collected about users’ online behavior for targeted advertising. Advertising networks can gather information about browsing habits, interests, location, devices, and the types of content users interact with. Attackers can take advantage of this advertising infrastructure and targeting capabilities to deliver malicious ads to specific groups of users, making their campaigns more relevant and increasing the chances that someone will click on them.

Malvertising Attack Techniques

1. Drive-by downloads

Drive-by downloads are a common malvertising technique in which malware is downloaded and installed on a device when a user visits a compromised website or interacts with a malicious advertisement. Attackers exploit vulnerabilities in browsers, plugins, operating systems, or other software to execute malicious code and infect the device without the user's knowledge or explicit approval. are a common malvertising technique in which malware is downloaded and installed on a device when a user visits a compromised website or interacts with a malicious advertisement. Attackers exploit vulnerabilities in browsers, plugins, operating systems, or other software to execute malicious code and infect the device without the user's knowledge or explicit approval.

2. Fake Software Update Advertisements

Fake software update advertisements are a common malvertising tactic that exploits users' familiarity with routine update notifications. Attackers create convincing ads or pop-up messages that imitate legitimate prompts from web browsers, media players, plugins, or other commonly used applications. These messages may claim that the user's software is outdated or that an urgent security update is required. When the user clicks the supposed “Update” button, they are directed to a malicious download instead of the legitimate software provider. The downloaded installer may look authentic, but it has been modified to contain malware such as an information stealer, remote-access tool, or backdoor.

3. Fake Browser Alerts

Fake browser alerts are another common malvertising tactic that uses deceptive pop-ups and notifications to trick users into taking potentially dangerous actions. These alerts are designed to resemble legitimate browser, operating system, or security warnings and may claim that the device has been infected, that an important update is required, or that the user needs to enable notifications to continue. The attacker may encourage the victim to click “Allow” to enable browser notifications or download a supposed security tool or software update. If the user grants notification permission, attackers can abuse the browser's notification feature to send a continuous stream of unwanted advertisements, fake warnings, phishing links, and other malicious content directly to the device.

4. Impersonation

Cybercriminals often impersonate trusted brands, financial institutions, government agencies, software companies, and other well-known organizations to make malicious advertisements appear real. They may copy logos, colors, website layouts, product names, and other branding elements to create fake advertisements and landing pages that closely resemble the real ones. The goal is to exploit the trust users have in familiar organizations.

5. Fake CAPTCHA Campaigns

Fake CAPTCHA campaigns use familiar security checks to trick users into carrying out malicious actions. In these attacks, a malicious advertisement or compromised webpage redirects the victim to a fake CAPTCHA page that closely resembles a real "I'm not a robot" verification. Instead of simply verifying that the visitor is human, the fake CAPTCHA instructs the user to follow a series of steps, such as opening a system utility and pasting or entering a command. On Windows, this may involve the Run dialog, while macOS users may be directed to use Terminal. Following these instructions can execute malicious code on the device and begin a multi-stage infection process. The downloaded payload usually installs an infostealer, which can collect sensitive information such as browser passwords, cookies, authentication tokens, and cryptocurrency wallet data.

6. Fake Sponsored Ads

Cybercriminals can abuse search engine advertising to place malicious sponsored advertisements where users are most likely to see them. Attackers often target searches for popular software, applications, brands, services, or other frequently searched terms. Because these advertisements can appear above or alongside real search results, users may assume they are clicking on the official website.

Malvertising Campaigns

1. Trapdoor Android Malvertising Operation

Researchers recently uncovered a large Android malvertising and ad-fraud operation called Trapdoor, involving 455 malicious Android applications and 183 attacker-controlled HTML5 domains. The associated applications were downloaded more than 24 million times, while the operation generated as many as 480 million advertising bid requests per day at its peak. The malicious apps were used to trigger hidden advertising activity and connect users to attacker-controlled domains, creating a self-sustaining cycle in which app installations helped generate revenue that supported further malvertising activity. Google later removed the identified malicious applications from Google Play.

2. AI-Themed Malvertising and Fake Software Campaigns

Microsoft reported that AI-themed malvertising campaigns are now impersonating popular AI brands and products, including ChatGPT, Microsoft Copilot, DeepSeek, and Claude. In one campaign, attackers moved from launching the operation to reaching tens of thousands of endpoints within hours. The attackers used fake AI software names, malicious pop-ups, redirects, GitHub repositories, and malware installers to distribute multiple payloads. Microsoft noted that these campaigns can rapidly change their lures and payloads, allowing criminals to take advantage of major AI trends and newly released products almost immediately

How to protect yourself from Malvertising

Malvertising can be difficult for both users and website publishers to detect and prevent. One major reason is the enormous volume of digital advertisements being created and distributed every day. Ads can move rapidly through advertising exchanges and networks, making it difficult for publishers to directly monitor every advertisement or fully control the verification process. Although eliminating the risk of malvertising can be difficult, users can take several steps to reduce their exposure and protect their devices.

1. Keep your browser updated

Install browser security updates as soon as they become available. Updates often fix vulnerabilities that attackers could exploit through malicious websites or advertisements.

2. Ad Blocking Software

Ad-blocking software can provide an additional layer of protection against malvertising by preventing advertisements from loading on websites. Blocking ads can reduce the chances of accidentally interacting with dangerous content. Ad blockers are available as browser extensions and standalone applications, and some can also block known malicious domains, trackers, and unwanted scripts. However, they should not be treated as a complete security solution.

3. Be careful with search advertisements

Sponsored results are not automatically safe. Users should therefore avoid assuming that the first sponsored result is the official source. When searching for software or services, consider navigating directly to the official provider rather than clicking an unfamiliar advertisement.

4. Don't ignore unexpected downloads

If a website unexpectedly downloads a file, do not open it simply because the download started automatically. Check what the file is and where it came from.

5. Use browser security features

Enable features such as Safe Browsing and other built-in protections that can warn you about malicious websites, downloads, and deceptive content.

Conclusion

As attackers continue to refine their techniques, malvertising is likely to remain an effective gateway for malware. Preventing malvertising requires more than simply avoiding suspicious-looking advertisements. Users, businesses, publishers, advertising networks, and security providers all have a role to play in identifying malicious campaigns and disrupting them before they can reach large audiences.

How Malvertising Is Becoming a Major Gateway for Malware

What Is Malvertising?