Understanding Malvertising Attacks

A common theme in cybersecurity recently has been the increasing innovation of attack methods.

We have witnessed an uptick in the use of highly evasive threat techniques designed to enable threats actors to bypass traditional security tools - from secure web gateways and firewalls to phishing detection tools and malware analysis engines.  

Malvertising is a particularly interesting and often complex attack technique used by attackers where malicious code is embedded into online and banner ads, videos, and other forms of digital advertising after successfully compromising third party servers. If someone then clicks on a compromised ad, they could either be redirected to spoofed websites created using social engineering tactics, or malware is downloaded directly onto their device. 

The aim is to execute malware on a user’s endpoint. If this is achieved, a range of malicious activities can be carried out – from changing, deleting, or leaking data on the dark web, to redirecting internet traffic to malicious websites, and developing backdoor routes to vital network systems.  

Capitalising On Lack Of Awareness

We are predicting a spike in malvertising campaigns during the latter half of 2023 with the emergence of image generators such as DALL.E and Midjourney, and AI tools like ChatGPT, which threat actors can use to create convincing malvertising campaigns that users are often unaware of. 

In a recent survey, Menlo Security found that 70% of respondents were unaware that endpoint devices could be infected with malware through clicking on a brand logo. This is despite the fact that the vast majority of people admit they click on advertisements online ‘to some extent’.

Almost half of our sample (48%) were unaware that they could be infected by clicking on social media ads, while one in four were oblivious to the potential threats posed by pop-ups and banners. This compares to other more high profile threats like phishing, with around three-quarters of respondents aware they can be infected by malware when they click on an email link.

It can be difficult for users and publishers to identify the difference between what ads are genuine and which are malicious, especially when both serve consumers through legitimate advertising networks. It’s estimated that around one in 100 online ads is malicious at present.

Even the most credible brands and websites are not immune to malvertising. A recent study by Menlo Security revealed that Microsoft, Facebook, and Amazon were the top three most impersonated brands by malicious threat actors attempting to steal personal or confidential data.

Best Practice For Combatting Malvertising 

The opportunity for threat actors is on the rise. Unlike email-based attacks and other methods, many of us are not aware that digital ads can be leveraged as a highly convincing attack vector.

Given the threats, it’s important that users online follow best practice in order to combat this threat. 

1.    Check the brand logo:   It’s important to look closely at the brand logo. Is it squashed, pixilated or stretched? Are the colours odd? These could be signs an advert is not legitimate. 

2.    Check the URL:   By scanning over the ad (but not clicking) the URL will appear. This allows users to check for any anomalies – threat actors may just change one or two characters, but these can always be spotted on close inspection.

3.    Do not assume credible websites are safe:   Credible websites are likely to have higher ad vetting processes, but this does not mean they are immune to malvertising. The same rules apply – always be cautious when clicking on ads.

4.    Beware of calls to action:   While marketers are more interested in gather data surrounding impressions and conversions, attackers will be pushier. Any ad asking to ‘buy now’ or ‘click here’ should be treated with extreme caution. 

5.    Beware of redirects:   Any new ad you click on is likely to take you to a new website with lower vetting procedures than the one before. You are only three to seven clicks away from malware online, so the more ads you click on, the higher chance you have of encountering malware.

The lack of malvertising awareness combined with greater and easier access to AI tools and image generators provides the perfect cocktail for even relatively inexperienced threat actors to exploit.

We expect an uptick in these types of attacks over the coming months so it’s important that organisations and end users get ahead of the game now. 

Tom McVey is Senior Sales Engineer EMEA at Menlo Security

You Might Also Read: 

Malvertising Proliferates As Half Of Online Ads Are Now AI Generated:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« Embracing The Passwordless Future
DORA: Compliance With The EU Digital Resilience Act »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

UCD Centre for Cybersecurity and Cybercrime Investigation

UCD Centre for Cybersecurity and Cybercrime Investigation

UCD Centre for Cybersecurity and Cybercrime Investigation is Europe's leading centre for research & education in cybersecurity, cybercrime and digital forensics.

Exodus Intelligence

Exodus Intelligence

Exodus Intelligence are an industry leading provider of exclusive zero-day vulnerability intelligence, exploits, defensive guidance, and vulnerability research trends.

Information Security Group (ISG) - Royal Holloway

Information Security Group (ISG) - Royal Holloway

The Information Security Group, Royal Holloway, University of London, is an Academic Centres of Excellence in Cyber Security Research.

AcceptLocal

AcceptLocal

AcceptLocal is a payments industry consultancy with expertise in payment processing, payment security, anti-money laundering and fraud prevention.

Centre for Cyber Security (CFCS) - Denmark

Centre for Cyber Security (CFCS) - Denmark

The Centre for Cyber Security is the Danish national IT security authority, Network Security Service and Centre for Excellence within cyber security.

Conscia

Conscia

Conscia provides IT infrastructure solutions and 24/7 services in network, data center, security and mobility.

Sandline Discovery

Sandline Discovery

Sandline Discovery provides digital forensics, eDiscovery solutions, managed review and litigation consulting services.

Vortiv

Vortiv

Vortiv Ltd (formerly known as Transaction Solutions International Ltd) is a technology based company focused on the cybersecurity and the cloud services sector.

Q-Net Security

Q-Net Security

Protect your critical networks. Q-Net Security make hardware that provides the strongest drop-in security for your existing critical infrastructure.

UKsec: Virtual Cyber Security Summit

UKsec: Virtual Cyber Security Summit

Join 100s of UK Cyber Security Leaders Online for Expert Cyber Security Talks, Strategy Insights, Cyber Resilience Tips and More.

Secure Technology Integration Group (STIGroup)

Secure Technology Integration Group (STIGroup)

Secure Technology Integration Group, Ltd. (STIGroup) is an innovative firm that provides CyberSecurity consulting, secure IT engineering, managed security services, and human capital solutions.

Kainos

Kainos

Kainos is a leading provider of Digital Services and Platforms. Our services include Digital Transformation, Cyber Security, Cloud, AI, IoT and more.

Great American Insurance Group

Great American Insurance Group

Great American's Cyber Risk Division offers cyber solutions for small and medium-sized businesses.

Red Goat Cyber Security

Red Goat Cyber Security

Red Goat Cyber Security have created excellent, informative and interactive Social Engineering Awareness training which is suitable for all levels of staff.

Tentacle

Tentacle

Tentacle has developed a configurable data management tool that helps organizations to improve their information security programs and overall security posture.

LEPHISH

LEPHISH

LePhish is a French cybersecurity solution specializing in automated phishing campaigns.