Malvertising

Malvertising is malicious advertising, embedding malware, scam redirects, or exploit code inside what looks like an ordinary ad, so that clicking it, or in some cases just having it load, can compromise a visitor's device or funnel them into a scam. It's distinct from an ad that's merely low-quality or aggressively salesy; malvertising specifically involves intent to harm or defraud through the ad delivery mechanism itself.

How it gets through the supply chain#

Malvertising typically exploits the same Ad Supply Chain complexity that makes legitimate programmatic advertising work: an ad exchange, a demand partner, and a Redirect Chain of intermediary domains between the ad slot and the final landing page. A bad actor can submit a clean-looking creative for review, then swap the destination or inject a payload after approval, or exploit weak vetting at one link in a long resold-inventory chain where no single party has full visibility end to end.

Common patterns#

A few patterns show up repeatedly: fake system alerts ("your device is infected") that lead to a scareware download; auto-redirects that hijack the page before a user clicks anything; and cloaked creative that shows reviewers a clean page but shows real visitors something else entirely, a technique closely related to Ad Cloaking and Cloaking (Affiliate Marketing). Malvertising and outright Click Fraud often travel together in the lowest-quality corners of programmatic inventory, though they're technically separate problems, one steals a click's value, the other harms the person who clicked.

Why it's hard to fully stop#

Ad networks run automated and manual review, but reviewers see the creative and destination at the time of submission, not necessarily what a bad actor swaps in afterward. Detection tends to be reactive: a spike in complaints or security-vendor reports triggers an investigation, the offending advertiser account gets pulled, and the cycle continues under a new account. This is a big part of why Brand Safety vetting for publishers and networks matters as much as ad-quality review for advertisers.

What to do if you spot it#

If you encounter what looks like malvertising, whether as a publisher whose inventory got exploited or a user who hit it, documenting the evidence, the creative, the landing page, the redirect path, matters more than just reporting it verbally. How to Report a Scam Ad walks through capturing that evidence properly before it disappears, since the offending creative and its redirect chain often get pulled or changed within hours of getting flagged.

Where transparency tooling helps#

A live, auditable record of what creative ran, when, and where it redirected is the practical countermeasure to malvertising's biggest advantage, that it's usually gone by the time anyone official goes looking. Tools built around continuous capture, rather than a one-time review at submission, are what make that evidence available after the fact through something like an Ad Intelligence index.