You do not have to visit a shady website to run into malware — sometimes it arrives through an ad on a site you completely trust. That is malvertising: malicious advertising that can infect your device or send you to a scam without you doing anything wrong. Our GetMyPassword team explains what malvertising is, how it works, and how to protect yourself.
What malvertising is
Malvertising is the use of online advertising to spread malware or scams. Attackers sneak malicious code into ads through ad networks, and those ads can then appear on completely legitimate, popular websites. Because the site itself is real and trusted, you never suspect the ad — which is exactly what makes the technique so effective.
How it reaches you
- Fake “update” or “virus” pop-ups urging you to download something now.
- Redirects that bounce you from a normal page to a scam or phishing site.
- Drive-by downloads that exploit an out-of-date browser, sometimes without a click.
- “You won a prize” banners leading to data-harvesting forms.
Why it is hard to spot
The trust comes from the surrounding site, not the ad. You might see a poisoned ad on a major news outlet or a familiar service and never question it. The most dangerous versions exploit unpatched software, so an out-of-date browser or plugin can be the difference between a harmless ad and an infection.
A real software update never arrives as a flashing ad telling you to act now. If a pop-up pressures you to download or install something, that urgency is the scam — close the tab and update through official settings instead.
How to protect yourself
Keep your browser, system and plugins updated, since malvertising thrives on old vulnerabilities. Use a reputable ad blocker or security tool, and never install “updates” or “fixes” offered by an ad — get software only from official sources. If you ever entered a login on a page reached through an ad, treat it as compromised: change that password with our password generator and turn on two-factor authentication so a stolen password cannot be used.
Frequently asked questions
What is malvertising?
Malvertising is malicious online advertising used to spread malware or scams. Attackers inject harmful code into ads that can appear on legitimate, trusted websites, infecting devices or redirecting visitors to scam pages.
Can I get malware from an ad on a legitimate website?
Yes. Malvertising can place poisoned ads on real, popular sites through ad networks. Keeping your software updated and using an ad blocker greatly reduces the risk, since many attacks rely on outdated browsers.
How do I protect myself from malvertising?
Keep your browser, system and plugins updated, use a reputable ad blocker or security tool, never install updates offered by ads, and get software only from official sources. Use unique passwords and 2FA as a safety net.