{"id":8637,"date":"2024-09-03T12:00:00","date_gmt":"2024-09-03T09:00:00","guid":{"rendered":"https:\/\/blog.eset.ee\/et\/?p=8637"},"modified":"2026-06-14T19:41:15","modified_gmt":"2026-06-14T16:41:15","slug":"in-plain-sight-malicious-ads-hiding-in-search-results","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2024\/09\/03\/in-plain-sight-malicious-ads-hiding-in-search-results\/","title":{"rendered":"In plain sight: Malicious ads hiding in search results"},"content":{"rendered":"

One thing is true: Malware developers are deeply invested in improving their malware and exploring different ways<\/a> to compromise end users. Malware spreading through ads is nothing new<\/a>; for a long time, cybercriminals have had their sights fixed on online advertising networks as a distribution vector. <\/p>\n

With just a click, a person\u2019s computer or even their entire network could become infested. And despite the continued use of ad blockers and sophisticated security software, malware spreading via ads is still a large problem \u2014 especially when they pose as ads for legitimate sites.<\/p>\n

How does malvertising in search engines work?<\/h2>\n

Following the boom of various search engines<\/a> throughout the 90s, and considering the ever-increasing encroachment of the online world on our physical daily lives, it is not surprising that ad firms would want to target such spaces.<\/p>\n

However, among these search advertisements, one could also find malicious ones. Malvertising campaigns typically involve threat actors buying top ad space from search engines<\/a> to lure potential victims into clicking on their malicious ads; attackers have delivered ads imitating popular software such as Blender, Audacity, GIMP, and MSI Afterburner, to name a few.<\/p>\n

No SEO tricks necessary \u2013 crooks paying for search ads automatically bring their malicious page to the top of people\u2019s search results. <\/p>\n

\n

Related: IISerpent: Malware-driven SEO fraud as a service<\/a><\/p>\n<\/blockquote>\n

Such was the case with a Bing ad posing as a VPN service \u2013 the ad\u2019s URL looked quite a bit like the legitimate one, with the linked website being a close facsimile of the real one. What\u2019s more, the downloadable solution (detected by ESET as MSIL\/Agent.CKL) hid a malicious payload: SecTopRAT<\/a>, a remote access trojan that enables attackers to take control of browser sessions and exfiltrate data. <\/p>\n

A similar story appeared in 2024, in which a threat actor leveraged fake domains, masquerading as IP scanner software<\/a>, and abused search ads to boost the visibility of their malicious pages.<\/p>\n

Thus, internet users searching for particular products could encounter such cases, with only subtle clues available to discriminate between a legitimate and a malicious ad or page.<\/p>\n

Whack-a-mole<\/h2>\n

In 2023, Google blocked or removed more than 1 billion ads<\/a> that had been abusing its ad network, including ads promoting malware. <\/p>\n

Other online advertisers are also victims. Due to the nature of the advertising business, bad actors can manipulate an entire advertising chain, compromising it in several possible ways \u2013 from buying ads and impersonating search engine providers<\/a> to hacking websites and ad servers<\/a>.<\/p>\n

While search engine providers continually remove malicious ads or websites from search results, hackers are persistent and keep on finding new ways to counter content filtering, creating a game of whack-a-mole between search providers and criminals. As a result, you can never be 100% certain whether what you click on is a malicious link.<\/p>\n

\n

Other forms of malvertising<\/h3>\n

Malicious search ads represent just one form of ad abuse by threat actors. Other types include the distribution of malignant banner ads, some even hiding bad code by using steganography<\/a>, on legitimate websites. Malicious ads can also be encountered via in-text hyperlinks, popups<\/a>, and more.<\/p>\n<\/blockquote>\n

How to protect against malvertising<\/h2>\n

Thankfully, there are steps you can take to protect against cyber threats, and the same is true for malvertising. Here are a few:<\/p>\n