In this edition of AdSecure’s Violations Report, we analyze Malvertising data collected from over 43 million prevention scans conducted on client campaigns. This data reveals how Malvertisers attempted to target websites and ad networks in Q3 2025. We will also discuss strategies to prevent these attacks from impacting your ad supply chain, ultimately safeguarding your online business and ensuring the safety of your end users. Read on to discover the most dangerous Malvertising trends from Q3 2025!
Most frequently targeted GEOs for Malvertising
Here are the 10 GEOs that experienced the most attempted violations in Q3.
As we can see, the US (36.9%) continues to have the most violation attempts in Q3, followed by Germany (9%) and the UK (8.3%), which remain the 3 most targeted countries by online scammers and cybercriminals. Followed by Italy (7.1%), which has continued to increase throughout the year, overtaking Canada(7.0%), France (6.7%). The Netherlands (6.5%) and Australia (8.5%), Spain(6.2%), and Switzerland (6.1%). Once again, all of the top targeted countries are Tier 1, as malvertisers continue to focus on GEOs that can bring them higher revenues.
Number of violations found per scan
With software like AdSecure, the number of violations per ad campaign can be detected. In Q3, we saw a decrease in the number of violations across 2,3,4 violations detected on one campaign. This is because Malvertisers are focusing on trying to get one violation passed the software rather than alerting it to three or even four, like they did previously. Therefore, we see an increase of 13.7% in 1 violation, -8.3% in 2 violations, -34.5% in 3 violations, and -.3% in 4 violations.
Largest ad violation increases in Q3, 2025.
Let’s take a look at the 10 largest increases in violations when compared to Q2 2025.
Pop-up violations
Pop-up violations saw a 270.30% increase this quarter. It is when advertisements that aggressively display unwanted or deceptive pop-up windows, often with urgent-seeming alerts or false information, are designed to trick users into clicking, calling, or downloading malicious software or navigating to a harmful site.
Phishing URL Webrisk
An ad creative or its landing page contains a URL that is flagged as a phishing risk by web security scanning services (Webrisk). Phishing attempts deceive users into providing sensitive information (e.g., login credentials, financial details) by impersonating a trustworthy entity. The number of Phishing URL Webrisk violations increased by 188.11% this quarter.
Malicious URL Webrisk
This violation continues to increase each quarter. It is when an ad creative or its landing page contains a URL that is flagged as generally malicious by web security scanning services (Webrisk), meaning it hosts or distributes malware, exploits vulnerabilities, or engages in fraudulent activity. This violation had a 184.95% increase when compared to Q2.
Malware
This is when the advertisement or its associated files attempt to automatically install or deliver malicious software (malware) onto the user’s device. This can occur through a drive-by download (no click required) or by tricking the user into downloading a malicious file. This violation increased by 158.06% this quarter.
Auto Vibrate
Although this violation can vary in severity, it is a violation of the Google guidelines. It is when an ad or its landing page uses code to trigger the device’s vibration function repeatedly or inappropriately, often alongside a deceptive message. Some ads will vibrate in order to get the end user’s attention, whereas others can have a more sinister message like “Your phone is infected!” to create a sense of urgency and manipulate the user into clicking a malicious link or downloading unwanted software. Auto Vibrate in ads increased by 92.80%.
Cryptocurrency Miner
This violation can have a negative impact on your brand as a landing page executes hidden scripts (often JavaScript) to illicitly use the user’s device processing power (CPU/GPU) to mine for cryptocurrency without their consent. This is a form of “cryptojacking” that degrades device performance and can come at a cost to the end user. This violation continues to increase each quarter substantially, with a 92.31% increase this quarter.
IAB Ad Weight
This is when the ad’s total file size (initial load and/or subload) exceeds the maximum weight limits set by the Interactive Advertising Bureau (IAB) or platform standards. This is a technical violation that significantly degrades user experience (slow loading). This violation had a 79.95% increase this quarter.
Permission Notification
The ad or landing page aggressively, deceptively, or inappropriately uses the browser’s legitimate notification request function to trick the user into granting push notification permission. Once granted, the malicious entity can flood the user with abusive notifications for scams, malware, or phishing. This violation saw a 68.41% increase this quarter.
JavaScript dialog on entry
This is when an ad or its landing page immediately triggers an unexpected and intrusive JavaScript dialog box (e.g., an alert, confirm, or prompt box) upon entry to the page. This is often used to lock the user on the page, prevent them from leaving, or deliver a deceptive message (like a fake virus warning) for malicious purposes. This violation saw a 59.16% increase this quarter.
Browser Locker violation
A browser Locker violation is a type of malicious software, often using JavaScript, that hijacks a user’s web browser, preventing them from closing the window or navigating away. It typically displays a fraudulent, intimidating message—sometimes impersonating a technical support service—to extort a payment from the end user. This type of violation has seen a significant 46.67% increase when compared to Q2.
How to prevent malvertising attempts on your network
In 2025, it is crucial to invest in a strong compliance team and effective ad security software to protect your ad supply chain and users from harmful advertisements. As malware campaigns increasingly target crypto platforms and Google tightens its policies on advertiser accounts, ensuring security has never been more important. Contact our team today to learn how to protect your advertiser accounts from attacks and start securing your ad network or website!
