What is malicious advertising?¶

Malicious advertising, often called malvertising, is the use or abuse of online advertising to deliver, redirect or support malicious activity.

Avoid the dangerous assumption¶

The dangerous assumption is that the website displaying the advertisement created or controlled the malicious content.

It may not have.

Advertising often passes through several platforms, exchanges and service providers.

A malicious advertisement may:

• redirect the user
• display a fake warning
• offer a fraudulent download
• lead to a phishing page
• attempt browser exploitation
• collect tracking information
• impersonate a known brand.

Investigators should preserve:

• the page on which the advert appeared
• the advert content
• the click or redirect chain
• the final destination
• timestamps
• browser and device records
• advertising or campaign identifiers
• related security alerts.

The content served may change quickly and may differ by location, device, time or user profile.

A screenshot may show appearance but not the full redirect or provider chain.

Do not assume that clicking the advert caused compromise. Establish what loaded and what happened afterwards.

Likewise, a malicious redirect does not automatically identify the advertiser, account holder or offender. Accounts and infrastructure may be compromised or created using false information.

Ask whether security tools or browser protections blocked the content before it reached the user. This may establish an attempted delivery without proving that the device loaded or executed the malicious component.

That distinction may materially affect the incident conclusion.

Preserve that blocking evidence explicitly.

Operational takeaway¶

Preserve the advertisement and full delivery chain, then separate display, click, redirection and resulting compromise into distinct evidential stages.