October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk4 min

Targeted Ads vs. Malvertising: How Online Ads Can Spread Malware

Personalized ads are not inherently malicious, but attackers can abuse advertising systems to redirect visitors, fake software downloads, or deliver malware.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Targeted advertising is not the same thing as malware. Targeted ads use personal data to help advertisers reach selected audiences; malvertising is the use of malicious or hijacked ads to spread malware. The danger is that attackers can abuse legitimate advertising systems—and sometimes tailor malicious campaigns to particular victims—so an ad shown on a familiar website is not automatically safe.

What targeted advertising means—and what malvertising means

The Federal Trade Commission’s 2020 primer describes targeted online advertising as the collection and use of personal data to help firms reach potential customers. The purpose is to select an audience for an ad; that alone does not make the ad malicious.

As an Amazon Associate I earn from qualifying purchases.

The Cybersecurity and Infrastructure Security Agency (CISA) defines malvertising as the use of malicious or hijacked website advertisements to spread malware. Attackers may get harmful ads into legitimate ad networks, or compromise advertising content. CISA warns that such ads can force a redirect or load a payload, and that an attacker may tailor an ad campaign to a specific victim.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

So “targeted” can describe two different things: ordinary ads selected for a consumer audience, or a malicious campaign aimed at particular people. The second is a form of abuse of advertising and web-delivery infrastructure, not a reason to treat every personalized ad as malware.

#1 Best Overall
Sale
TP-Link AX1800 WiFi 6 Router (Archer AX21 V5) | Dual Band Wireless Internet, Gigabit, Easy Mesh, Works with Alexa - A Certified for Humans Device
  • DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
  • AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
  • CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
  • EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
  • OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.

How a malicious ad can lead to malware

Malvertising does not always require a visibly suspicious website. An ad can be served on a legitimate page, and the ad’s delivery path may involve several networks or integrations. A reputable page therefore does not establish that every ad displayed on it is safe.

Redirect to a fake download

A click may send a visitor through an unexpected redirect to a cloned site that imitates a software vendor or download page. The visitor may then be prompted to install a file that contains malware. The FTC has warned about fake software ads, including ads for AI-related and other software.

Rank #2
Sale
TP-Link AC1200 WiFi Router Dual Band Wireless Internet Router (Archer A54) | 4 x 10/100 Mbps Fast Ethernet Ports, EasyMesh Compatible, Support Guest WiFi, Access Point Mode, IPv6 & Parental Controls
  • Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
  • Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
  • Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
  • Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
  • Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks

Genuine-looking software with a malicious payload

An ad may promote real software while the download being delivered has been altered or bundled with a backdoor. Google’s May 2025 company advisory describes malvertising as a popular tool for bad actors and explains that it can serve as the first step in a larger chain of abuse. Potential later consequences include stolen information or compromised accounts.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Automatic redirects and pop-ups

Google Ad Manager identifies automatic redirects and pop-ups as forms of malvertising. Google says it scans ad creatives and prohibits certain behaviors, but also cautions that third-party exchanges, networks, and integrations may not provide the same protections. A platform’s controls should not be assumed to cover the entire advertising ecosystem.

Rank #3
Sale
ASUS RT-AX1800S Dual Band WiFi 6 Extendable Router, Subscription-Free Network Security, Parental Control, Built-in VPN, AiMesh Compatible, Gaming & Streaming, Smart Home
  • New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
  • Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
  • Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
  • 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
  • Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.

Who may be targeted

Some malicious campaigns are broad, while others are tailored to selected victims. CISA notes that adversaries can target a specific victim; Google’s 2025 advisory discusses campaigns aimed at people with valuable online assets and sophisticated users. That means technical experience or a valuable account does not make someone immune, though it does not mean every targeted ad is an attack.

The FBI’s Internet Crime Complaint Center has also described malicious traffic distribution systems that can route visitors differently according to location or other characteristics and may be used to distribute malware. This is related evidence about selective traffic routing, not proof that every such scheme uses advertising.

Rank #4
Sale
TP-Link AXE5400 Tri-Band WiFi 6E Router, 2025 PCMag Editors' Choice | 2.5Gbps WAN Port for Gaming & Streaming, 6GHz Band, 160MHz, OneMesh, Dual-Core CPU, VPN & WPA3 (Archer AXE75)
  • Tri-Band WiFi 6E Router - Up to 5400 Mbps WiFi for faster browsing, streaming, gaming and downloading, all at the same time(6 GHz: 2402 Mbps;5 GHz: 2402 Mbps;2.4 GHz: 574 Mbps)
  • WiFi 6E Unleashed – The 6 GHz band brings more bandwidth, faster speeds, and near-zero latency; Enables more responsive gaming and video chatting
  • Connect More Devices—True Tri-Band and OFDMA technology increase capacity by 4 times to enable simultaneous transmission to more devices
  • Unique Design, More RAM, Better Processing - A unique housing design provides optimal heat dissipation, combined with a 1.0 GHz dual-core CPU and 512 MB High-Speed Memory, the AXE75 is designed for long-term reliability and performance.
  • EasyMesh-compatible - Extend network range even more by adding EasyMesh-compatible routers, extenders, or wireless powerline adapters for a seamless, whole-home connection. Eliminate dead zones, drops, and lag as you move across your home.

What the published numbers do—and do not—show

Available figures describe different things, so they should not be read as a current estimate of how often people encounter or are infected by malvertising.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Figure What it measured What it does not establish
More than 5% of unique daily IP addresses accessing Google Google Research authors’ 2015 study measured ad injection at that scale. It is not a current estimate of all malvertising, nor an infection rate.
50,870 Chrome extensions and 34,407 Windows binaries The same 2015 study identified these as client-side vectors; its authors classified 38% of the extensions and 17% of the binaries as explicitly malicious. These historical counts are not current totals of malicious software or affected users.
Over 1 billion advertisements blocked or removed during 2023 Google’s 2024 Ads Safety Report counted ads blocked or removed for violating its policy against abusing Google’s ad network, a policy that includes promoting malware. This is not a count of malware infections and does not measure all advertising networks or the total prevalence of malvertising.

These sources do not establish a current overall prevalence estimate for malvertising. The historical ad-injection study and Google’s platform-specific enforcement total also measure different phenomena in different periods.

Best Value
TP-Link AC1200 Gigabit Dual Band WiFi Router (Archer A6) | MU-MIMO Wireless Internet Router, 4 x Antennas, OneMesh and AP Mode, Long Range Coverage
  • Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
  • Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
  • Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
  • MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
  • Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How to reduce your risk as an individual

  • Do not use an ad as the route to a software download. The FTC advises that if an ad for software interests you, do not click it; instead, type the vendor’s known web address or use a trusted bookmark.
  • Keep devices and software updated. Install security updates for your operating system, browser, phone, and security software; enable automatic updates where available.
  • Be cautious with unsolicited prompts. If an ad unexpectedly redirects you or a page urges an unfamiliar download, close the page rather than following its instructions.
  • Use trusted sources for browser add-ons. The FBI’s IC3 advises avoiding plugins and themes from unverified developers.

Controls for organizations and agencies

CISA’s recommendations are federal-agency guidance and should be understood as possible layers in an organization’s security program, not as a requirement that every household buy special equipment. The appropriate mix depends on the organization’s systems, users, and risk profile.

  • Standardize and secure browsers so settings and protections can be managed consistently.
  • Deploy advertisement-blocking software where it fits the organization’s needs and policies.
  • Isolate browsers from operating systems to reduce the impact of malicious web content.
  • Implement protective DNS technologies to help prevent connections to known harmful destinations.
  • Consider network controls such as web proxies, DNS sink-holing, web filtering, and firewalls as part of a layered defense.

What publishers and ad operators can do when an ad looks suspicious

Google Ad Manager’s troubleshooting guidance recommends capturing enough context to investigate a reported ad. Useful details include a full-screen screenshot, browser and operating-system information, the system time, and information about what happened after a click. Available investigation and blocking options depend on which demand source served the ad.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.