What is adware? The malware that monetises your devices (2026)

Adware is software that automatically displays or downloads advertising on a device — and when it arrives without meaningful consent, it is malware. It is often dismissed as the harmless bottom of the malware pile, but in a business context adware is a symptom: it means defences have failed, and the same install path can carry something far worse. This guide explains how adware works in 2026, how to spot it, and how to get rid of it.

TL;DR

• Adware displays unwanted ads and monetises your browsing; malicious adware installs itself without real consent.
• It arrives bundled with free software, fake updates and browser extensions — the same routes as spyware.
• It degrades devices, drains bandwidth, and can hijack search results and inject ads into pages.
• Adware on a work device is a red flag: whatever installed it could have installed worse.
• Removal is straightforward, but the habit that prevents it — refusing bundled and "free" installs — is trained, not bought.

What adware actually does

Adware sits in an awkward category. Some of it is legal, if obnoxious: bundled in free consumer apps, disclosed in fine print, tolerated because the user accepted the terms. Some of it is outright malware — installed silently, hiding its uninstaller, and hijacking the browser to route revenue to whoever planted it.

What the malicious kind does:

• Injects or replaces ads on pages you visit, so the ad revenue goes to the attacker instead of the site.
• Redirects searches through tracking or affiliate domains that pay the operator per click.
• Opens pop-ups and notifications — increasingly via the browser notification system, after a deceptive "click to continue" prompt.
• Tracks browsing to target the ads, which means your activity is being collected and sold — the surveillance part overlaps with spyware.
• Resists removal by reinstalling through scheduled tasks, services or multiple extensions.

How adware gets onto a device

• Bundled installers. The classic: a free PDF converter, media player or "driver updater" whose setup wizard quietly ticks the adware's install box. Staff who click Next through installers install everything in the bundle.
• Fake software updates. A pop-up claiming your browser, Flash-era plugin or video driver needs updating.
• Malicious browser extensions. Extensions advertised as ad blockers, converters or shopping helpers that later push ads — extensions auto-update silently, so a once-legitimate one can turn.
• Deceptive notification prompts. A page that shows a "Press Allow to confirm you are not a robot" screen; allowing it hands the site a notification channel for push-ad spam.
• Mobile apps outside official stores. Repackaged apps on third-party Android stores.
• Drive-by installs on machines running outdated software.

Every one of these routes starts with a person accepting something — which is why adware is a training problem as much as a technical one.

Why adware matters for a business

Three reasons the "harmless" label is wrong in a workplace:

1. It is evidence of a failed control. Something installed itself on a work device without approval. Whatever installer did it was not vetted — and the next one in that chain may be a trojan rather than an ad injector.
2. It breaks compliance. Employee activity is being monitored and advertising profiles built on machines that may handle personal or health data — an exposure Australian privacy law does not care for, and an auditor's finding waiting to happen.
3. It costs real productivity and bandwidth. Devices slow down, browsers fill with pop-ups, and search results route through redirect chains — the machine users stop trusting.

Signs of adware

• Ads appear on sites that never show them, or ads appear in places a browser normally renders nothing — the desktop, the start page.
• The homepage, default search engine or new-tab page has changed without anyone changing it.
• Browser extensions nobody installed, which cannot be removed easily.
• Constant pop-ups, including outside the browser.
• Searches redirect through unfamiliar domains before results arrive.
• The device is noticeably slower, or mobile data usage climbs with no change in behaviour.

How to remove adware

1. Uninstall unknown programs from Windows Settings or macOS Applications — anything nobody remembers installing, especially recent "utilities" and "updaters".
2. Audit browser extensions in every browser, and remove anything unrecognised. Reset the homepage and default search engine afterwards.
3. Revoke rogue notification permissions: in browser settings, check the sites allowed to send notifications and remove the ones that should never have been granted.
4. Run a full scan with updated endpoint protection, which catches the persistent helpers that reinstall adware.
5. Check scheduled tasks and startup entries for anything unfamiliar that relaunches the adware after removal.
6. Rotate credentials if the device is a work machine — the same install path may have carried credential-stealing extras, and a scan cannot prove a negative.

How to prevent adware

• Restrict software installs to admin-approved tools. A staff account that cannot install programs cannot install adware — the single most effective control.
• Allow-list browser extensions and audit them quarterly; block the Chrome or Edge web store on managed devices where practical.
• Block macros and drive-by paths by keeping software patched and using DNS filtering.
• Train the refusal habit. "Free converter" and "allow notifications to continue" prompts are social engineering with a monetisation model. Monthly security awareness training rehearses exactly those moments, and human risk reporting shows whether the click behaviour is changing over time.
• Keep endpoint protection live on every device, including phones used for work.

Adware vs spyware vs trojans

The overlap in install routes is the point: adware is the cheap end of the same pipeline that delivers the expensive threats.

FAQ

What is adware in simple terms? Software that shows you ads you did not ask for. When it installs without real consent, hides itself or hijacks browser settings, it is malware.

Is adware dangerous or just annoying? Annoying first, dangerous second. Directly it steals attention and bandwidth; the real risk is what it proves — an unapproved installer ran on the device, and that same pipeline delivers credential stealers and trojans.

How did adware get on my computer? Usually bundled with free software or a fake update, through a malicious browser extension, or by clicking "Allow" on a deceptive notification prompt.

How do I remove adware from a browser? Remove unknown extensions, reset the homepage and search engine, revoke notification permissions you never intentionally granted, then run a full endpoint scan to catch the helpers that reinstall it.

Does a factory reset remove adware? On a phone, yes in almost every case. On a PC, a clean reinstall works too, but it is overkill: removal plus a scan handles typical adware.

Can iPhones get adware? Rarely — iOS is locked down. Safari content blockers and configuration profiles installed by a third party can misbehave, but classic adware infections are overwhelmingly a Windows, Android and browser-extension problem.

One last thing

Check one browser on one shared machine today: open the extensions list and the site notification permissions. Anything nobody can explain is a finding — and the fix takes five minutes. Multiply that across your fleet and adware stops being a slow drip of lost productivity and becomes a closed door.

Related guides

• What is spyware? — the silent cousin sharing the same install routes.
• What is a trojan? — what the next installer in that chain might carry.
• Compare awareness platforms — how platforms differ on automating the prevention habit.