The average cost of a data breach reached a staggering $4.88 million in 2024 (opens in a new tab), a 10% increase since the previous year. This shows that data breaches and Malvertising attempts are on the rise, and the cost to Publishers and website owners continues to increase. In this article, we will explore AdSecure’s Violations Report and analyze Malvertising data extracted from over 44 million Malvertising prevention scans run on client campaigns. With this data, you will discover how Malvertisers attacked websites and Ad Networks in Q2 2025. You will also learn how to prevent such attacks from affecting your ad supply chain, ultimately protecting your online business and your end users’ safety. Keep reading to learn about the most dangerous Malvertising trends that occurred in Q2 2025 and how to prevent ad violations!
Malvertising trends in Q2 2025: Violations detected per scan
In Q2 2025, almost 1 in 5 scans by AdSecure showed that ads contained at least one violation. This percentage includes any violation under User Security, User Experience, User Advisory, and IAB Standards violations. These violations can significantly impact the online user experience, your online brand reputation, and Google ranking. More serious violations can compromise data security, damage devices, disrupt navigation, or expose users to explicit content. So, it is important to have a solution like AdSecure to protect your online business from Malvertiser activity.
Here’s the percentage breakdown of every violation detected in Q2 2025 compared to Q1 2025:
As you can see, the number of violations detected have increased since Q1. The most significant increase was the number of scans with two violations in Q2, which increased by +25.5%, meaning that it continues to be important to monitor and use a Malvertising solution like AdSecure.
10 most targeted GEOs by cybercriminals, Q2 2025
Here is a breakdown of the 10 most targeted countries that experienced the most violations in Q2 of 2025.
As we can see, the US is a third of all violations detected at 32.9%, Germany came second at 8.7% followed by the UK in third place at 8.4%. But looking at totalling the EU countries up we can note there is a massive 53.5% of violations. All of the most targeted countries are Tier 1 GEOs. We can speculate that this may be due to the higher disposable income in these countries. Malvertisers might believe they can make more money and gather more valuable data to sell in these countries.
10 most detected violations in Q2 2025: User Security Violations
Let’s take a look at the increase in User Security violations that occurred in Q2 2025 compared to Q1 2025. These usually involve either intentional violations like Phishing and Malware, but can also be accidental violations that could cause data leaks or vulnerabilities that can help Malvertisers infiltrate individual or organizational data.
In Q2, the most significant of these violations was the SSL non-compliance with a +47.9% increase in violations. This violation involves at least one unsecured item in a chain of resources. For example, if the domain link is missing the ‘s’ from ‘https’, an expired SSL certificate, mixed content issues, unsafe redirects, or a cipher mismatch.
Most detected violations in Q2 2025: User experience violations
These are violations to the user experience, and they can have lasting effects on the brand or website that hosts ads with these violations. When comparing Q1 & Q2, we discovered the following:
JavaScript Alert on exit increased by +358.5%. This is an alert that pops up when the user wants to close an active tab. JavaScript Alert on entry also experienced an increase of +293.8%. This is when a JavaScript alert pops up without any end user interaction upon site entry.
Permission request to track the end user’s location, which increased by a shocking +337.9% increase. While permission requests increased by +58.6% on notifications.
Auto Redirects had a +126.9% increase in Q2 2025. They are ads that contain a script causing a web page to break out of any frames, resulting in an automatic redirect that forces the end user to another website or page.
**Back Button Hijacks increased by +32.6%. **These violations involve ads that have a script embedded in them that allows the advertiser to manipulate the browser history. Usually, it consists of inserting one or several pages in the browser history, which would prevent the user from going back to the previous page he was coming from, thus affecting the end user experience.
Most detected violations in Q2 2025: User Advisory violations
Heavy Ads increased by +547% in Q2. These are ads that violate Google’s heavy ad intervention policy (consume more than 4MB of network bandwidth; use CPU for 15 seconds or more within a 30-second window; use CPU for 60 seconds or more in total) and get blocked by the Chrome browser. It is paramount to ensure that webpages are free of resource-intensive ads that slow down the user experience and impact the website’s performance. AdSecure audits all ad creative sizes and notifies the client whenever a heavy ad is spotted, which ensures advertisers have the best campaigns.
Drive-by or cryptocurrency mining was up +200% in Q2, 2025! This refers to ads that use a piece of JavaScript code to mine different cryptocurrencies directly through the visitor’s browser and use the end user’s resources without them knowing.
IAB ad compression violations were up +58.3%. To optimize the file size for delivery of an ad to a browser, the assets within the ad should be delivered in compressed formats such as gzip. This detection flags ads that are not compliant with the IAB standards within this category, which means they are not delivered in a compressed format.
Suspicious TLDs (Top-level domains) were up +33.1%. These are domains frequently used by cybercriminals who are setting up hosts for spam e-mailing, scams, shady software downloads, malware distribution, botnet operations, and phishing attacks, or other suspicious content. Please note that it may not be necessary to block all domains flagged as suspicious, but it is our policy at AdSecure to inform you of their potential relationship to malicious activity so that you can make an informed decision.
Conclusion: Dangerous Malvertising Trends in Q2 2025 and how to stop them
Q2 saw a definite increase in Malvertiser activity, as highlighted above. This is why it’s essential to invest in both a strong compliance team and effective ad security solution to protect your ad supply chain and users from harmful ads. With companies like Microsoft support dealing with bad actors, fake ads targeting crypto platforms, and Google cracking down on advertiser accounts, ensuring security is more important than ever. Contact our team to learn how to safeguard your brand and advertiser accounts from Malvertising attacks and begin securing your ad network or website today!
