How to stay safe from malicious advertising online?

In an ideal world, the online ads you see are trustworthy and have no malicious intent. However, this is not always the case. Some ads, rather than promoting legitimate products or services, are designed to spread malware or perform security breaches, such as stealing users' personal information.

These malicious ads are often cleverly disguised, making it difficult for users to distinguish and easily become victims of cyber attacks.

What is malvertising?

Malvertising, a portmanteau of “malware” and “advertising,” is not simply advertising to sell malware to cybercriminals, as the name might suggest. Instead, it is a sophisticated tactic in which ads are designed to appear legitimate but actually contain dangerous threats.

These ads are often used to trick users into clicking on them, which then secretly downloads malware onto their devices or redirects them to malicious websites that collect personal information, install spyware, or carry out other cyberattacks. This is a particularly dangerous form of attack because it exploits users' trust in trustworthy online platforms.

The main goal of malvertising is to infect your device with malware and steal personal information, causing serious security consequences. To achieve this, malvertising typically uses two main methods:

Malicious ads before you click:These types of ads are particularly dangerous because they don’t require you to take any action, like clicking or entering any information. Just by loading the ad in your browser, the malware hidden inside can automatically be activated, infecting your device without you even knowing.

Malicious ads after click:These ads don't trigger themselves when your browser loads them. Instead, they entice you to click on them, leading you to a malicious website where the site may try to infect your device with a virus or ask you to provide personal information in a phishing attack, aiming to steal important data.

Note that malicious advertising is different from adware, which are unwanted applications designed to display advertisements to users. However, in some cases, the two types of software can work together. Cybercriminals can deploy adware on users' computers to display malicious advertisements, combining annoyance with potential security risks.

How do malicious ads appear?

Malware, with its long history and ever-evolving forms, has become a threat that cannot be ignored in the digital world. From simple tricks to annoy users to sophisticated campaigns that scam and spread malware, malware has proven its incredible adaptability and harmfulness.

Proving that even the biggest websites aren't immune to malicious ads, a series of ads dubbed SYS01 InfoStealer have hit Facebook users in a massive campaign. The ads are designed to trick users by promising free access to popular services and software, like Netflix and Photoshop.

However, when users click on these ads, instead of getting what they were promised, they are tricked into downloading malware that can steal personal information, damage devices, or lead to other attacks. These incidents show that even large and trusted online platforms can be targeted by malicious ads, putting unsuspecting users at risk.

While Google is considered a master at filtering out harmful ads, sometimes small "loopholes" still appear. Some ads that appear in search results may be irrelevant or even misleading.

According to CNBC, cybercriminals have taken advantage of Google's sponsored ads to scam users. They create fake ads that impersonate reputable websites or make overly attractive promises, making it easy for users to fall into the trap.

Cybercriminals are getting more and more sophisticated in creating fake search results that look exactly like reputable websites. They invest in pushing these malicious links to the top of search results. This makes it difficult for users to distinguish between real and fake, and makes it easy for them to fall into scams.

Many social media platforms allow users to pay to increase interactions for their posts. Cybercriminals have taken advantage of this "loophole" to promote malicious ads. They buy likes and shares to increase the credibility of malicious content, thereby defrauding and hijacking users' accounts.

Japan-based security firm Trend Micro has uncovered a sophisticated scam on Facebook. Cybercriminals have stolen accounts and then used them to promote fake AI photo editing apps. When users download and install the app, criminals gain access and control of the victim's device.

How to stay safe from malicious advertising online?

Although malicious ads may sound very sophisticated and dangerous, in reality, they often leave some recognizable traces. So, to stay safe from malicious ads, you need to pay attention to the signs and implement the following safety solutions:

The ads are too attractive

The main goal of malicious advertisers is to get as many users as possible to click on their ads. Since they don’t have a quality product or service to offer, they often make unrealistic promises and overly attractive deals to lure users in. This way, they don’t have to take responsibility for the misinformation they provide.

As the SYS01 InfoStealer case has shown, scammers are willing to offer users tempting offers like free access to Netflix and Photoshop. These are clear promises to prey on users’ greed and mask their true purpose of stealing personal information.

Ads containing spelling and grammatical errors

Malicious ads are often hastily created and poorly thought out, so they can easily reveal flaws in language and grammar. If you notice an ad with many errors or unnatural wording, be careful because it could be a sign of malicious advertising.

Ads with "Unprofessional" graphic design

Unlike reputable companies that invest heavily in professional graphic design, malvertising creators often don’t have the resources to do so. As a result, malvertising ads often have poor image quality, confusing layouts, or use low-resolution images. This is easily noticeable to the naked eye and is a clear sign that the ad is not trustworthy.

Double check the advertising information on the official websites

Having trouble deciding on a deal that seems too good to be true? Take some time to verify the information before making a decision. The easiest way is to open a new tab and go directly to the company's official website or social media channels to check the information.

If an ad claims to be from a reputable company, you should double-check the information on the company’s official website or social media channels. All advertising content should be clearly and transparently posted there. As for companies you are not familiar with, be cautious and do your research before making a decision.

Be careful when clicking on ads

We tend to click on the first links to save time, but be careful! Scammers are always looking to take advantage of this psychology to trick users. Remember the malicious ads on Google, we need to be more careful when clicking. Instead of hastily clicking on marked ads, take a moment to scroll down and click on the search results of reputable websites.

Use a secure web browser

We know how to avoid the risks of clicking on ads, but the danger can still lurk even before we take action. Some malicious ads can automatically launch as soon as a website loads. To protect yourself from these threats, it is important to choose a secure and reliable web browser. The browser will act as a solid layer of protection, helping you prevent attacks from malicious ads.

In short, in the world of online advertising full of traps, bad guys always try to take advantage of users' curiosity to trick them into downloading malware, viruses or other dangerous files. By equipping yourself with the necessary knowledge on how to recognize and avoid malicious ads, you can effectively protect your computer and personal data.

Phan Van Hoa