{"id":7846,"date":"2026-10-22T17:43:13","date_gmt":"2026-10-22T10:43:13","guid":{"rendered":"https:\/\/adtek.agency\/glossary\/malvertising\/"},"modified":"2026-10-22T17:43:13","modified_gmt":"2026-10-22T10:43:13","slug":"malvertising","status":"publish","type":"mona_glossary","link":"https:\/\/adtek.agency\/en\/glossary\/malvertising\/","title":{"rendered":"Malvertising"},"content":{"rendered":"

Malvertising (malicious advertising) is the use of online ads to spread malware or send people to scam pages. Because criminals buy ads through legitimate ad networks or hijack businesses’ ad accounts, malicious ads can show up right on a search results page.<\/p>\n

What is malvertising?<\/h2>\n

Most forms of ad fraud<\/a> go after the advertiser’s money. Malvertising goes after the viewer. Businesses get pulled in when their brand is impersonated in scam ads, or when their own landing pages and ad accounts are hacked.<\/p>\n

Google defines malware as software that aims to harm or get unapproved access to a computer, device or network. Google Ads places malicious software under its Abusing the ad network policy. Intentionally distributing malware gets an account suspended on detection, without prior warning (Google Ads Help, Abusing the ad network, accessed October 2026<\/a>). Examples include ransomware, spyware, and forced redirects to an infected site when the user hasn’t clicked the ad (Google Ads Help, Malicious software, accessed October 2026<\/a>).<\/p>\n

The same policy family covers cloaking: showing Google and users different content to hide a violation (Google Ads Help, Circumventing systems, accessed October 2026<\/a>).<\/p>\n

In 2025, Google blocked or removed more than 8.3 billion ads, and Abusing the ad network was the largest category at more than 1.29 billion. On the publisher side, more than 2 million pages were actioned for malware or unwanted software (Google, 2025 Ads Safety Report, April 2026<\/a>).<\/p>\n

How malvertising works<\/h2>\n
    \n
  1. Search ads that impersonate brands.<\/strong> Criminals buy ads using a domain that looks like a real business and link to a page that looks identical to the official site. People searching for software download malware named after the program they wanted, and people searching for crypto exchanges hand over their login details (FBI IC3, December 2022<\/a>).<\/li>\n
  2. Redirect chains on low-quality sites.<\/strong> In December 2024, Microsoft detected a campaign that hit nearly 1 million devices: redirectors sat inside video frames on illegal streaming sites and passed users through four to five layers before reaching malware hosted on GitHub (Microsoft Security Blog, March 2025<\/a>).<\/li>\n
  3. Hacked landing pages.<\/strong> A legitimate website gets injected with code that launches pop-up ads, redirects visitors or installs malware, for example through a CMS vulnerability. Google Ads calls this a compromised site and disapproves ads that point to it (Google Ads Help, Compromised sites, accessed October 2026<\/a>).<\/li>\n<\/ol>\n

    Signs your business is affected<\/h2>\n