Advertising enables free content. Without online advertising, many publishers would be forced to charge users through subscriptions or other methods of payment to view their content. On the flip side, it’s a way for companies to promote new services, products and discounts.

But advertising is also becoming increasingly attractive to cybercriminals as a vehicle for spreading viruses, spyware and ransomware. This has contributed to the rise of malvertising.

Malvertising 101

A portmanteau of “malicious advertising,” malvertising involves injecting malware into advertisements on legitimate websites or through online ad networks.

The first such exploits were observed less than 10 years ago and are now extremely widespread. According to The Register, incidents of malvertising increased by 260 percent in 2015, and the resulting damage is estimated at around $1 billion.

Malvertisements can take the form of normal ads, pop-ups or notifications to download or update fake software. Most malvertising campaigns are short-lived. In some cases, they start as benign ads and are generally placed on reputable websites. Cybercriminals inject viruses into the website’s code to turn legitimate ads into malicious ones.

After a mass infection is complete, attackers hide their tracks by quickly removing the virus from the code. In other cases, legitimate ads are targeted directly. Many major organizations have been attacked this way.

Prevention Techniques

While no method can guarantee protection against malvertising, users can take steps to reduce the likelihood of being infected. Basic security hygiene is key. This involves keeping all software up to date with the latest patches, including your operating system and web browser.

Anti-Exploit and Antivirus

Anti-exploit programs can shield devices from vulnerabilities aimed at operating systems and browsers. Some antivirus programs offer such capabilities as well. There are also separate programs that run alongside antivirus software to monitor browsers for malicious exploits. Some antivirus programs also offer safe browsing capabilities that alert users when a website is potentially harmful.

Ad Blockers

Ad blocking programs offer some defense against malvertising, and these options are becoming increasingly popular with users. Advertisers and publishers, however, have suffered backlash related to this software. According to The Wall Street Journal, the use of ad blockers cost the advertising industry $22 billion in 2015. Digiday, meanwhile, reported that some experts expect the cost to balloon to $35 billion by 2020. Websites are increasingly requiring users to disable ad blockers to access content.

Click-to-Play Plugins

Another way to combat malvertising pop-ups is to enable click-to-play plugins. This requires a user to actively click on a pop-up before it plays to reduce the chance of infection. Users should also disable unused plugins and ensure that all plugins in use are updated.

Malvertising is a nuisance that can affect anyone, from individuals to the largest enterprises. The best strategy is one of prevention through awareness. If something doesn’t look legitimate, don’t trust it.

More from Risk Management

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Worms of Wisdom: How WannaCry Shapes Cybersecurity Today

WannaCry wasn't a particularly complex or innovative ransomware attack. What made it unique, however, was its rapid spread. Using the EternalBlue exploit, malware could quickly move from device to device, leveraging a flaw in the Microsoft Windows Server Message Block (SMB) protocol. As a result, when the WannaCry "ransomworm" hit networks in 2017, it expanded to wreak havoc on high-profile systems worldwide. While the discovery of a "kill switch" in the code blunted the spread of the attack and newly…

Why Operational Technology Security Cannot Be Avoided

Operational technology (OT) includes any hardware and software that directly monitors and controls industrial equipment and all its assets, processes and events to detect or initiate a change. Yet despite occupying a critical role in a large number of essential industries, OT security is also uniquely vulnerable to attack. From power grids to nuclear plants, attacks on OT systems have caused devastating work interruptions and physical damage in industries across the globe. In fact, cyberattacks with OT targets have substantially…

Resilient Companies Have a Disaster Recovery Plan

Historically, disaster recovery (DR) planning focused on protection against unlikely events such as fires, floods and natural disasters. Some companies mistakenly view DR as an insurance policy for which the likelihood of a claim is low. With the current financial and economic pressures, cutting or underfunding DR planning is a tempting prospect for many organizations. That impulse could be costly. Unfortunately, many companies have adopted newer technology delivery models without DR in mind, such as Cloud Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS)…