Don’t let online ads trick you: How to recognize malvertising

You’re searching Google for a PDF editor. A sponsored result appears at the top of the page. It looks legitimate, so you click it.

Instead of downloading the software you expected, you install malware.

This type of attack is called malvertising, and it’s an increasingly common way cybercriminals trick people into visiting fake websites or downloading malicious software.

Unlike phishing emails or text messages, malvertising hides in places you normally trust, including search engines and well-known websites.

What is malvertising?

Malvertising, short for malicious advertising, is when criminals use online advertisements to distribute malware or send people to fraudulent websites.

These advertisements often look completely legitimate. They can appear on trusted news sites, shopping websites, blogs, or even in sponsored Google search results.

The goal may be to:

• Steal usernames and passwords.
• Install malware.
• Trick you into downloading fake software.
• Collect personal or financial information.
• Redirect you to scam websites.

Because the advertisement appears alongside legitimate content, it can be easy to assume it’s safe.

What does malvertising look like?

Malvertising doesn’t always look suspicious. Some common examples include:

• Sponsored search results for popular software.
• Ads claiming your computer is infected.
• Pop-ups urging you to update your browser immediately.
• Fake software downloads.
• Browser extension advertisements.
• Ads offering expensive software for free.

Attackers rely on people clicking quickly without taking a moment to verify what they’re seeing.

How to protect yourself

• Be cautious with sponsored search results: Paid advertisements often appear above normal search results. If you’re looking for software or a service, consider typing the company’s web address directly or using a bookmark you already trust instead of clicking the advertisement.
• Download software only from trusted sources: Whether you’re installing Zoom, Adobe software, browser extensions, or another application, download it from the vendor’s official website or through approved university resources whenever possible.
• Keep your browser and computer updated: Software updates often fix security vulnerabilities that attackers try to exploit.
• Enable automatic updates whenever possible so your browser, operating system, and applications stay protected.
• Watch for fake urgency: Legitimate companies rarely use scare tactics through online advertisements. Be skeptical of messages such as:
  • Your computer is infected.
  • Update now.
  • Limited-time security scan.
  • Your browser is out of date.
    
• Think before you click: If something feels off, don’t interact with the advertisement. Instead:
  • Search for the company yourself.
  • Visit the organization’s website directly.
  • Ask your IT support team if you’re unsure.

Keep in mind

• Cybercriminals are constantly looking for new ways to gain your trust.
• Malvertising works because it blends into websites and search results you already trust.
• A healthy dose of skepticism, combined with good security habits, can go a long way toward protecting both your personal information and university data.