Malvertising

Malvertising (malicious advertising) is the use of online ads to spread malware or send people to scam pages. Because criminals buy ads through legitimate ad networks or hijack businesses’ ad accounts, malicious ads can show up right on a search results page.

What is malvertising?

Most forms of ad fraud go after the advertiser’s money. Malvertising goes after the viewer. Businesses get pulled in when their brand is impersonated in scam ads, or when their own landing pages and ad accounts are hacked.

Google defines malware as software that aims to harm or get unapproved access to a computer, device or network. Google Ads places malicious software under its Abusing the ad network policy. Intentionally distributing malware gets an account suspended on detection, without prior warning (Google Ads Help, Abusing the ad network, accessed October 2026). Examples include ransomware, spyware, and forced redirects to an infected site when the user hasn’t clicked the ad (Google Ads Help, Malicious software, accessed October 2026).

The same policy family covers cloaking: showing Google and users different content to hide a violation (Google Ads Help, Circumventing systems, accessed October 2026).

In 2025, Google blocked or removed more than 8.3 billion ads, and Abusing the ad network was the largest category at more than 1.29 billion. On the publisher side, more than 2 million pages were actioned for malware or unwanted software (Google, 2025 Ads Safety Report, April 2026).

How malvertising works

1. Search ads that impersonate brands. Criminals buy ads using a domain that looks like a real business and link to a page that looks identical to the official site. People searching for software download malware named after the program they wanted, and people searching for crypto exchanges hand over their login details (FBI IC3, December 2022).
2. Redirect chains on low-quality sites. In December 2024, Microsoft detected a campaign that hit nearly 1 million devices: redirectors sat inside video frames on illegal streaming sites and passed users through four to five layers before reaching malware hosted on GitHub (Microsoft Security Blog, March 2025).
3. Hacked landing pages. A legitimate website gets injected with code that launches pop-up ads, redirects visitors or installs malware, for example through a CMS vulnerability. Google Ads calls this a compromised site and disapproves ads that point to it (Google Ads Help, Compromised sites, accessed October 2026).

Signs your business is affected

• Searching your brand name turns up ads using your name with a misspelled domain.
• Ads get disapproved for Compromised site, Search Console flags security issues, or Chrome shows a red Safe Browsing warning.
• Your ad account has new users or ads pointing to unfamiliar domains.

How to protect your business

1. Turn on 2-step verification for every admin on your ad accounts and review the user list regularly.
2. The FBI recommends using a domain protection service that alerts you when lookalike domains are registered, and telling customers where to find your official downloads.
3. Keep your CMS, themes and plugins updated. If ads are disapproved for Compromised site, remove the injected code, check the site in Safe Browsing, then appeal. Google warns at least 7 days before suspending an account for this issue.
4. For display campaigns, exclude placements such as pirated streaming sites. It protects brand safety and keeps you away from malicious redirectors.

Malvertising vs. similar terms

Frequently asked questions

Is malvertising the same as adware?

No. Adware is software already on the device that shows ads by itself. Malvertising travels through real ads, and it can be one way adware gets installed.

Can you get infected just by seeing an ad?

Google’s policy does describe forced redirects that happen without a click. In the FBI’s warning, the malware came from files users downloaded themselves.

If you want a second look at who has access to your ad accounts, your landing pages and your placements, contact Adtek.