Malvertising is malware delivered through online advertising: a criminal buys ad space on legitimate platforms — search engines, news sites, social media — and the ad itself or its landing page infects or deceives the person who clicks it. The victim did not receive a phishing email and did not mistype a domain. They searched for a real product, clicked an ad that outranked the real site, and landed on a pixel-perfect copy of it. This guide covers how malvertising works, why it has become one of the most effective attack formats of 2026, and what a small business should do about it.
TL;DR
- Malvertising places malicious ads on legitimate networks; the ad or its landing page steals credentials or installs malware.
- The dominant 2026 pattern: fake download sites for real software — 'Download TeamViewer' or 'Download Advanced IP Scanner' — that outrank the vendor's own site in sponsored results.
- The ad platform does not protect you: paid slots sit above organic results and borrow the platform's own legitimacy.
- Defences: bookmark real portals, verify domains character by character, block ads at the network layer, and patch whatever slips through.
- Training turns 'I clicked a sponsored link' from an embarrassment into an instant report that shrinks the damage window.
Why malvertising works so well
Every other attack in this series asks the victim to trust something that arrives: an email, a text, a call. Malvertising asks them to trust the internet's own front doors. Search engines and news sites carry the legitimacy of their brand, and a paid slot at the top of the results inherits it. The user who searched 'TeamViewer download' has no reason to doubt the first result — and in malvertising campaigns, that first result is the attacker's.
Three properties make the format unusually effective:
- Position. Sponsored results sit above organic ones. The real vendor's site is literally second on the page.
- Legitimacy transfer. The ad carries the search engine's or publisher's credibility, not just the impersonated brand's.
- Intent. Unlike phishing, the victim arrives with their guard down: they were trying to do their job — download a tool, log into a portal — not scrutinise a message.
How a malvertising campaign works
- The attacker buys ad inventory on a legitimate network, passing whatever ad review the platform runs — increasingly well disguised, often by advertising benign content initially and swapping the destination later (ad cloaking).
- The ad targets high-intent searches: 'download TeamViewer', 'Advanced IP Scanner', 'Notepad++', 'AnyDesk download', accounting software, HR portals. The impersonated brands are tools staff install or portals staff log into daily.
- The landing page clones the real one. Pixel-perfect copies of vendor download pages or login portals, often hosted on domains one character away from the real one — the typosquatting infrastructure described in our guide to lookalike domain attacks.
- The payload varies by victim. A consumer may get a fake 'update' that installs an info stealer; a business visitor may get a credential-harvesting page for their SSO portal; an admin may be served a trojanised installer of the very tool they searched for.
What malvertising costs a business
Direct damage follows the payload. A fake installer delivers an infostealer that sweeps browser passwords, session cookies and crypto wallets; a fake portal harvests the credentials of staff logging in with their normal work password. From there the damage is the familiar cascade: mailbox takeover, invoice fraud, deeper intrusion. The Australian baseline applies: the Australian Signals Directorate logged more than 84,700 cybercrime reports in 2024-25 — one every six minutes — with small business averaging $56,600 per report (ASD Annual Cyber Threat Report 2024-25).
There is also a quieter cost most businesses never attribute correctly: slow devices, strange extensions and odd pop-ups that trace back to a download that came from an ad months earlier. Malvertising infections often sit undetected for weeks, quietly feeding stolen sessions to marketplaces, until something downstream — a fraud alert, a colleague's odd email — surfaces them.
How to spot a malvertising trap
- Check the domain character by character before you click or log in. The fake domains are engineered to read correctly at a glance; the defence is deliberately unglamorous: read the address bar letter by letter, especially on a login or download.
- Bookmark real portals. Any site staff use daily — HR, payroll, banking, vendor portals — gets a bookmark, and staff use the bookmark, not search. This single habit defeats most malvertising campaigns outright.
- Treat sponsored results as untrusted. Paid placements are bought with money, not earned with security. That does not make every ad malicious; it makes every ad unverified.
- Hover before clicking on desktop to preview the actual destination domain.
- Be suspicious of download prompts mid-session — fake 'update your browser/plugin/Java' overlays on otherwise normal sites are a classic malvertising payload.
How to stop malvertising at the organisation level
- Network-level ad blocking. DNS filtering that blocks ad and tracker domains removes most malvertising before any browser loads it, and reduces malvertising exposure to near zero for staff browsing.
- Patch fast. Malvertising payloads exploit the same unpatched browsers and plugins as every other attack class. Critical patches on internet-facing and endpoint software within 48 hours.
- Endpoint protection with behaviour detection — catches the infostealer that got past the ad and the fake installer.
- Restrict local admin rights. Most fake installers need admin rights to persist. Standard users stop them.
- MFA on every account — a harvested password alone should not be enough to take over a mailbox or a portal.
- Train the click habit. The reflexes malvertising defeats — search, click, trust the top result — are trainable. Cyber Aware's security awareness training rehearses lookalike-domain and fake-download lures monthly, and anyone who clicks a simulated lure gets remediation the same day. Human risk reporting then shows month by month whether click rates are falling and reporting is rising.
For the technical side — DNS filtering, patch cadence, endpoint coverage, admin rights — a cyber security gap assessment shows which controls you can already evidence and which to close next.
FAQ
What is malvertising in simple terms? Malware or fraud delivered through online advertising: a criminal buys ad space on legitimate platforms and sends clicks to fake download pages or login portals that steal credentials or install malware.
Is malvertising the same as phishing? Related but distinct. Phishing sends the lure to the victim (usually by email); malvertising places the lure where the victim is already searching or browsing. Both end at the same fake page — malvertising just skips the inbox.
How do I know if a download link is safe? Go to the vendor's site directly — bookmark it once and use the bookmark — and download only from there. Sponsored results and third-party download portals are unverified regardless of how legitimate they look.
Does an ad platform's security protect me? Partly: platforms scan ads and ban malicious campaigns when detected, but ads are reviewed before serving and cloaked campaigns swap their destination after approval. Position in sponsored results is bought, not earned, and carries no security guarantee.
Can malvertising infect my computer without a click? Rare in 2026. Most modern malvertising needs a click — either to the fake page or a fake installer. Historic drive-by malvertising (infecting through an exploit on page load) is largely closed by modern browsers and their rapid update cycles.
What should staff be told about malvertising? Bookmark daily-use portals and download software only from bookmarked vendor sites; treat sponsored results as unverified; and report a suspicious download or login page the moment it happens — the report shrinks the damage window more than any single technical control.
One last thing
Run one check this week: list the tools and portals staff search for — TeamViewer, AnyDesk, Notepad++, payroll, HR — and bookmark the real URLs for the whole team. Every search that becomes a bookmark is one malvertising campaign that has no way to reach your staff.
Related guides
- What is typosquatting? How URL hijacking works — the lookalike-domain infrastructure malvertising sends clicks to.
- What is a trojan? The malware that hides in plain sight — the payload fake installers carry.
- Compare Cyber Aware with other platforms — how the delivery model stacks up.