Security · Article 9 of 10
Ads that lead to malware, and sites you shouldn't trust
Some online ads impersonate real businesses to deliver malware or steal passwords. The FBI warns they can look almost identical to the real result. Platforms stop most of them before anyone sees them, but not all. For your bank, email and software, type the address yourself and download only from the official site.
Malware, in plain words: a program made to harm a device or to spy and steal from it. Viruses, programs that steal passwords and programs that lock your files until you pay are all malware.
What "malvertising" is
In December 2022 the FBI warned that criminals buy search ads that imitate real businesses, with "minimum distinction between an advertisement and an actual search result." The ads lead to look-alike pages that offer "a link to download software that is actually malware," or that "host ransomware and steal login credentials and other financial information."1
Platforms catch most of them
Google reports that in 2025 it blocked or removed more than 8.3 billion ads, including 602 million tied to scams, suspended 24.9 million advertiser accounts, and stopped over 99% of policy-violating ads before they were served.2 That is a lot of protection. At that volume, though, even a small share that slips through reaches many people.
Low-trust sites are where it starts
In March 2025, Microsoft described a campaign that began on illegal streaming websites. Ads on those sites sent visitors through four or five redirects and ended in downloads hosted on well-known platforms like GitHub. Microsoft estimates it affected more than one million devices, installing programs that steal information.3
Now, some don't even need a click
On October 15, 2026, Citizen Lab at the University of Toronto published the first public confirmation of spyware delivered through targeted ads with no click at all. In its words, "The simple display of a targeted ad is enough for infection." At least 45 devices at Al Jazeera were targeted in 2024 and 2025. Ads carrying the suspicious code appeared on almost 200,000 websites and apps between March and June 2026, although seeing one of those ads does not by itself mean a device was infected. Google and IAB Europe removed the company behind it from their vendor lists in early October 2026.4
This was aimed at specific people, not at small businesses in general. It does show why habit 5 and keeping every device updated matter more each year.
Five habits that keep you out of trouble
- For your bank, email and accounts, type the address yourself, or use a bookmark you saved. The FBI recommends typing the address instead of searching for it.1
- Download software only from the official site or the app store. Never from an ad, even if it looks right.
- Check the address before you type a password. One misplaced letter is all it takes.1
- Stay away from pirate streaming and download sites. That is exactly where the campaign Microsoft describes began.3
- Consider an ad blocker on work computers. The FBI suggests an extension that blocks ads during internet searches.1
If you already clicked or installed something
Disconnect the computer from the internet, run a full scan with your antivirus, change your passwords from a different device you trust, and call your bank if you entered card or account details.
Ask me how we do it for your business, on a free 30-minute call.
General information, not technical or legal advice.
Charted and signedOctober 2026 · Alejandro Peñuela
Every claim in this article points to its source.