Threat Intelligence Archives

Mobile continues to grow in dominance as the device that generates the most internet traffic. According to Oberlo, in February 2023, 60.67% of all web traffic came through smartphones. Cybercriminals know this too and will target malvertising at mobile websites just as much as desktop websites. The question is, how to protect mobile advertising from cybercriminals? And how do Cybercriminals attack mobile users? AdSecure examined violation detection data during Q1 2023. It found that mobile advertising violation detections stood at 46.7% and desktop violation detections at 53.3%. Let’s take a closer look to see the many different tactics used to target malicious advertising at mobile devices.

Mobile browsers and malvertising

According to Statista Android maintained its position as the leading mobile operating system worldwide in the fourth quarter of 2022, with 71.8% share, while iOS accounted for around 27.6% of the mobile operating system market. However, if we look at AdSecure’s violation detection data for iOS devices using Safari versus Android devices using Chrome, it is more disproportionate, with Safari attacks at 44.7% and Android Chrome attacks at 55.3%.

Insight: Because iPhone users tend to be more affluent, Cybercriminals clearly try to attack iOS mobile users with as much effort as Chrome users.

Top 3 targeted mobile devices for detections per operating system

iOS devices for detections:

iPhone 8

iPhone 8+

iPhone X

Android devices

Samsung Galaxy S10

Nexus 6

Google Pixel 3

As you can see these device models are older than the current latest models from manufacturers. iPhone 8 was released back in 2017 and in the Android list, Nexus 6 was released in 2014 and is now discontinued.

Insight: How do Cybercriminals attack mobile users? Cybercriminals target older handsets because in some cases, older handsets tend not to have the latest software protection updates. They also assume that less tech savvy people tend not to get the latest smartphone models or upgrade their devices for many years. This makes them prime targets for malicious activity. So what was that malicious activity in Q1 targeting mobile devices?

Mobile Q1 violation types

Looking at the share of each violations category detected on mobile, let's see how Cybercriminals attacked mobile users in more detail:

How do Cybercriminals attack mobile users? User Security violations

In Q1, the top 2 violations which took the lion's share of violations were SSL non compliance, which detects ads that contain at least one unsecured item in the chain of resources (unsafe, no https, mixed content, ssl version or cipher mismatch). The second largest was Malicious URLs which are inserted into ads with the intent of hosting all kinds of unsolicited content such as spam, phishing, and drive-by exploits. Like other kinds of malvertisements, a Malicious URL is designed to lure unsuspecting users to scam sites, which can lead to serious issues such as monetary loss, theft of sensitive information, and the appearance of malware. At first sight, Malicious URLs can look like legit landing page URLs intended to be a part of an ad’s sales funnel. They can go completely undetected by ad platforms and publishers, representing a real threat for the end user.

Top 5 most scary User Security violations for end users

Taking a deeper dive into AdSecure’s detection data, there are a selection of violations that are perhaps the scariest to happen to an end user on their mobile device. In Q1 there were no detections found for Randsomware, perhaps the one violation that brings the most fear for end users, by blocking their device and files unless a ransom is paid. But this did not stop Cybercriminals attempting to exploit end users with the following user security violations:

Browser Locker 42.3%: This violation disables any form of action that can close the browser. In a better scenario, advertisers force users to accept Push Notifications in the browser, otherwise it will loop the users in the browser. In a worse scenario, all attempts to close the browser will result in a warning message box appearing. The purpose of browser lockers is not only to scare but also to create the illusion that the mobile device has been locked. What's happened is that the browser is stuck in between a flurry of alert dialogs that won't seem to go away, no matter how many times they are clicked on.

Drive by Cryptomining 31%: Cybercriminals hijack the end users mobile device to use its processor to secretly mine for Crypto currency for the Cybercriminal. Also called Crytpojacking, the end user has no idea their device has been hijacked.

Unwanted Programs 14.5%: This violation downloads unwanted software on the end users mobile device via an executable file or mobile application. Programs could be malware, fake antivirus software, etc.

Scareware 7.1%: These are ads claiming that the end user’s mobile device is infected with a virus and that the end user needs an antivirus software, which may, ironically, actually contain a virus that could harm the mobile device, causing costly repairs or, even worse, lead to identity theft. Scammers often use the names of well-known companies that specialize in software to gain end user trust. The Scareware pop-up advertisements aim to mimic genuine warning alerts generated by security software.

Phishing 5.1%: After clicking on an ad the end user is sent to a phishing site which aims to trick the end user into revealing their personal information (for example, passwords, phone numbers, or credit cards). The content pretends to act, or looks and feels, like a trusted entity — for example, a browser, operating system, bank, or government.

How do Cybercriminals attack mobile users? User Experience violations

User Experience violations damage the end user experience on how they interact with ads served on a publisher site. Here are the top 5 User Experience violations AdSecure detected in Q1 on mobile:

Landing Page Error 44.2%: This is when an end user receives an alert when the system identifies a broken/dead link (404 Error, 5xx, timeouts, etc.) on the ad’s landing page or when a broken link is identified in the path (intermediate redirect links inside the chain) between the click URL and the landing page.

Back Button Hijack 24.6%: Back Button Hijacking is an ad security threat which manipulates the end user’s browser history, keeping them stuck on a certain page by inserting one or several redirects in their browser history, to then forward them back to that specific page. This abusive behavior of hijacking a user's browsing history has been considered a violation by Google Advertising Policies.

Javascript Dialog On Entry 15.9%: A Javascript alert that pops up without user interaction on entering a website.

Permission Notification 10.3%: This violation attempts to ask the end user for permission to send notifications to them.

Auto Redirect 5%: Ads that contain a script causing a mobile web page to break out of any frames "framing" it, resulting in automatically redirecting the visitor to another potentially malicious website/page.

How do Cybercriminals attack mobile users? User Advisory violations

User Advisory violations can provide a poor user experience, driving end users away from websites. This affects the traffic quality of websites and also trust in the websites' ads. The top 5 User Advisory violations AdSecure detected in Q1 are as follows:

Threat Intelligence 34.6%: This detection is based on AdSecure’s Threat Intelligence service and reports if the URL was flagged for a violation in any AdSecure analysis in the previous 30 days.

Unsafe adult content 32.5%: This violation shows ads to end users that contain ad creatives featuring adult content which may contain elements such as nudity, pornographic images or cartoons, or sexual activities. Publisher sites do not want to show ad creatives featuring pornography to end users, unless it is an adult website. It is also potentially harmful for children to be exposed to these ads.

Suspicious TLD 23.1%: Free or suspicious top-level domains are frequently used by Cybercriminals who are setting up hosts for spam emailing, scams, shady software downloads, malware distribution, botnet operations and "phishing" attacks, or other suspicious content.

IAB Standards 8.1%: The IAB Standards measure the performance of ads against the IAB Industry standards to stay Google compliant, more on this in our next section.

Crypto ad 1.7%: As cryptocurrency advertising has been regulated by more and more countries, this AdSecure detection identifies misleading or non-compliant cryptocurrency promotions.

IAB Standards and mobile advertising

AdSecure’s IAB Standards detections are crucial to ensure that ad networks and publishers are serving ads that meet the online advertising industry standards set by the Interactive Advertising Bureau (IAB). This can mean the optimal weight of an ad served, serving pixelated or squished ad creative images, etc. If an end user sees a squashed ad image for example, he is unlikely to click on the ad. Not only does this affect the professional image of the publisher's site that is serving the ad, but also the ad network that is supplying the demand.

In total, 4.24% of all ads targeting mobile devices scanned by AdSecure in Q1 2023 showed that the ads did not meet the IAB industry standards. That's 1 in every 23 ads on mobile. Of the four IAB Standards AdSecure scans and detects, here are the percentages of each detection in Q1 2023:

Two particularly important IAB Standards are the Ad Dimensions and Ad Weight detections. For example, the mobile screen is small and therefore the ad creatives dimensions need to fit into the standard mobile ad format sizes for an optimal end user ad experience. Secondly, 53% of mobile users abandon a site if it is slow to load, and Google penalizes websites that load too slowly. If the website is serving heavier than the industry standard ad weights, this will slow down a mobile device, which could lead to Google rankings for the website being affected.

Malvertising on mobile, the conclusion

According to Statista, in 2022, mobile advertising spend worldwide was estimated to be worth 336 billion US dollars. By 2023, the mobile advertising market is expected to grow to 362 billion US dollars, a growth of 7.73%. With such a high market value, mobile advertising is the biggest growth sector for ad networks and publishers to monetize. With this huge volume it is easy to see how and why Cybercriminals attack mobile users, they use various tactics to secretly inject malicious advertising campaigns into the ad supply chain. This is highly damaging for ad networks and publishers, not to mention the end user who ends up becoming a victim. As mobioes are now core to everyone's existence, if a Cybercriminal succeeds in infecting or taking over a mobile device, the effects can be devasting for the end user.

Now you can see how Cybercriminals attacked mobile users. So how do you protect mobile ads? AdSecure offers 360 degree monitoring and protection for your ad supply chain by automating your ad verification process before ad campaigns go live & while they are running. Why not start a free 14 day trial and find out how AdSecure can protect your business from Cybercriminals.