Ad injection

Ad injection is when software or a browser extension on a user’s device inserts ads into other people’s websites, or replaces the ads already there with its own, without the site owner’s permission. The site owner earns nothing, and advertisers pay for impressions and clicks from a dirty source.

What is ad injection?

A user installs a Chrome extension or a free program bundled with another download. The software can read and change page content. When the user opens a news site, a search page or an online store, it adds banners and pop-up ads or swaps out the original banners. Viewers assume the site owner put the ads there, while their browser slows down and their data may be collected.

The Media Rating Council (MRC) lists “adware and malware that conduct deceptive actions including ad injection and unauthorized overlays” as sophisticated invalid traffic (SIVT) that measurement companies must filter (MRC, IVT Standards Addendum, June 2020). In April 2024, the MRC added a requirement to report IVT rates by domain and app, and recommended putting sources with heavy adware and malware activity on block lists (MRC, 2024 IVT Interim Updates, April 2024). It is one branch of ad fraud on the web.

How big is it? Google’s research

The first in-depth study of the ad injector ecosystem came from Google working with the University of California, Berkeley and Santa Barbara (Google Security Blog, May 2015):

• 5.5% of unique IPs accessing Google sites had injected ads.
• More than 50,000 browser extensions and more than 34,000 software applications took control of browsers to inject ads. Upwards of 30% were outright malicious and also stole account credentials.
• More than 3,000 advertisers, including Walmart, Target and eBay, unknowingly paid for this traffic, because they generally see only the final click that brings a visitor to their site.
• Google removed 192 deceptive Chrome extensions that had affected 14 million users.

The numbers are more than 10 years old, but the Chrome Web Store’s current policy still says an extension’s ads may not interfere with ads on third-party sites. An extension may show ads alongside another site only if it discloses this clearly, attributes the ads’ source, doesn’t interfere with the site’s own ads and doesn’t impersonate the site’s content (Chrome Web Store, Ads policy, November 2022).

Warning signs

• Customers send screenshots of your site showing banners or pop-ups you never placed.
• Your placement report shows clicks from major sites you didn’t buy, with high click-through rates but very short time on site.
• On the publisher side: page views rise while ad revenue stays flat.

How to protect yourself

1. Buy display ads through partners whose measurement vendor filters SIVT, and ask for IVT reports by domain and app as the MRC requires.
2. Check placement reports weekly and exclude sites with abnormal bounce rates.
3. Don’t install extensions from unknown sources on computers used to manage ad accounts.

Hypothetical example

A brand buys display ads from an ad network at a CPC of VND 3,000. The report shows 20,000 clicks, or VND 60 million in spend. Checking the data, 6,000 clicks came from ads injected onto major news sites, with under 2 seconds on site. The brand paid VND 18 million for traffic that never came from a legitimate ad slot.

Ad injection vs. similar terms

Frequently asked questions

How is ad injection different from adware?

Adware is the tool. Ad injection is one thing adware commonly does: inserting ads into other people’s pages.

How can users get rid of ad injection?

Open the browser’s extensions page, remove any extension you don’t remember installing or no longer use, then reload the page to check.

If you want help reviewing placement reports and IVT rates across your ad sources, contact Adtek.