“Malvertising” – a term blending “mal” (as in malware) with “advertising”) is broadly defined as the malicious abuse of internet advertising by criminals to achieve a wide range of nefarious goals. “Malvertisers” use scam ads, auto-redirecting, compromised landing pages, cloaking, drive-by download attacks, and other techniques to dupe users into engaging in dangerous information sharing actions likely to endanger the security of their identities, finances, and perhaps even their lives.
Malvertising is problem that’s been plaguing the internet ad industry for more than a decade. Unfortunately, as my guest, Micheal Lyden, Vice President of Threat Intelligence at the Trust Accountability Group (TAG), observes, it’s not a problem that will likely go away any time soon.
As TAG notes on its website, “Malvertising is now a problem at scale. Recent research suggests that despite improvements in the digital ad landscape, nearly 1 in every 100 ad impressions were still impacted by a malicious or disruptive ad, suggesting that more than 20% of user sessions may be impacted by malvertising. The financial impact of malvertising has grown apace as well. In 2018, it was estimated that the industry lost $210 million annually to auto-redirects, and another $920 million from the ads auto-redirects facilitated with click fraud.”
I wanted to sit down with Michael to discuss the current malvertising threat environment and talk about what TAG is doing to make things better. As he notes, social engineering is rising as a malvertising modality. “Because modern browsers have gotten so secure, it’s harder than ever to download malware from an ad. It really requires you as the internet user to do something: to click through a series of prompts and install the malware or install some other kinds of software at the behest of a criminal group. So social engineering really becomes the key method for criminal groups to get you to do something.”
Michael and I discuss the potential risks of generative AI in digital advertising, including its abuse by criminals to create convincing content and bypass traditional countermeasures. Michael notes that criminals are opportunistic and will exploit weaknesses in the industry, making it essential for digital advertising to stay vigilant and adapt to new threats. He emphasizes the importance of staying nimble, advancing cooperation within the industry, and liaising with law enforcement entities to keep malvertising at bay.
The discussion then turns to the topic of potential vulnerabilities within the affiliate marketing industry to nefarious actors, given its complex ecosystem and lack of information sharing among a large group of independent companies.
We close our discussion with Micheal’s hopes and plans for the Trust Accountability Group in 2024, which will include an expanded mission to protect intellectual property by demonetizing pirated content.
If you’re interested in learning more about malvertising and what’s being done to combat it, I highly recommend that you visit TAG’s “threat sharing” page and download its Malvertising Taxonomy. Developed to help standardize the definition of malvertising, it includes a glossary of terms, along with a summary of different malvertising techniques that are in wide use today.
