Malvertising scams are becoming more sophisticated, with companies like WordPress (opens in a new tab), Netflix, and Microsoft being targeted. Read on to learn more about these scams and how to protect your end users from Malvertising scams.
Malvertising Campaign Hijacks WordPress Sites
A large-scale malvertising campaign is currently compromising outdated WordPress websites and delivering malware to millions of users. Threat actors are injecting malicious advertisements into these sites, often disguising them as fake software updates or browser error messages. This breach could affect all end users, as both Windows and macOS users are targeted. Many users unknowingly download what they think are legitimate updates, but these are actually data-stealing malware.
How the Attack Works
Malvertisers are using drive-by downloads (opens in a new tab), which allow them to infect systems without any user interaction. This approach takes advantage of trusted ad networks on popular platforms, making detection extremely challenging. Campaigns like “ClearFake” and “ClickFix” have compromised over 6,000 WordPress sites. The downloads are placed into deceptive banners—such as fake updates for Chrome, Facebook, Google Meet, or captcha prompts—to trick users into installing malicious payloads. Harmful elements are often disguised as harmless WordPress plugins for marketing purposes, such as SEO or caching tools. This disguise allows them to evade detection by site administrators, particularly if the WordPress site isn’t updated on the latest malvertising scams and views these plugins as enhancement tools.
Recommendations for site owners and users to protect against search engine scams
This escalating malvertising threat highlights the critical need for both proactive web hygiene for site operators and vigilance from users to avoid being manipulated by seemingly harmless advertisements. Malware can run silently and reinfect sites. Here are two ways end users can avoid viruses.
Never download unexpected software prompted by an ad.
Use up-to-date browsers and antivirus solutions.
If you are an Ad Network or a Publisher, you can detect Malvertising by using a comprehensive monitoring and protection for the ad supply chain, like AdSecure. It includes scans for malvertising, ad quality, and compliance to help avoid unsafe, inappropriate, and non-compliant ad content.
Search Engine Scams Target Major Brands like Bank of America, Netflix, and Microsoft
Cyber scammers are also exploiting search engine listings, particularly paid ads on Google, to trick customers of major brands like Bank of America, Netflix (opens in a new tab), and Microsoft (opens in a new tab). Instead of directing users to fake websites, the scam leads them to the legitimate brand’s website, but with a crucial alteration called the “search parameter injection”.
How do “Search Parameter Injection” scams work?
The fraudsters use a technique called “search parameter injection” to display their fraudulent IT support number directly within the website’s search bar. When unsuspecting users call this number, the scammers pose as brand representatives to extract personal data, credit card details, or even gain remote access to the victim’s computer. Other targeted brands include PayPal, Apple, Facebook, and HP.
How to Spot and Avoid Search Parameter Injection Scams
These scams are particularly difficult to detect because the legitimate website URL appears in the address bar, and the site itself is otherwise identical to the real one. Watch out for:
Urgent language like “Call Now!”
Text appears in the search bar before you type; be especially vigilant with phone numbers.
The presence of encoded characters (e.g., “%20” for a space, “%2B” for a plus sign) accompanies the support number link in the URL.
These types of scams are becoming more common with Malvertisers veering away from the traditional malvertising efforts and targeting end users with offers of free AI video makers and fake crypto ads. If you want to protect your brand and boost your ad security, try AdSecure, the Malvertising Prevention & Ad Quality Solution! We offer 360-degree monitoring and protection for your ad supply chain by automating your ad verification process before ad campaigns go live & while they are running. Ready to level up your cybersecurity? Get in touch with our team or start a free 14-day trial now (opens in a new tab) to see how AdSecure can help you protect your brand.
