September 17, 2015 By Shane Schick 2 min read

Security researchers say a malvertising campaign that ran for three weeks before it was discovered highlights the need for businesses to be more vigilant about the kind of companies that participate in online ad networks through programmatic buying.

Several well-known firms, including Answers.com, the Drudge Report and eBay’s U.K. operation, were among the sites that served up ad content that exposed online audiences to the Angler exploit kit, according to an investigation by Malwarebytes. It was a particularly successful example of malvertising, where malicious software is hidden in what look like otherwise legitimate digital ads. Those who clicked on the bogus ads were then subject to attacks from cybercriminals, who could take over their system, demand money or steal personal information. In this particular case, however, clicking on the ads took computer users to sites where they were hit with malware.

As The Register explained, the cybercriminals behind the campaign went to great lengths to try to deceive anyone who might be involved in the online ad-buying process. This includes linking ads back to sites that had been registered with the Better Business Bureau years ago and submitting ads that were completely clean. However, part of the problem involves the use of real-time bidding engines, which essentially gives online advertisers a self-service mechanism for distributing malvertising to unsuspecting publishers.

The onus for staying on top of malvertising may lie less with the publishers than the ad networks, SC Magazine suggested. In this case, those involved included AppNexus, Doubleclick and others. As website owners start to realize that ads can be delivered from the cybercriminals’ own servers via an encrypted HTTPS connection, there may be need for additional checks to ensure the content being served up doesn’t lead to malware. It could also mean some form of testing before ads can go live. For example, Malwarebytes researchers noted that links within the ads were often redirected multiple times before landing on an infected site — something that could have been realized with quick tests before the ads went live.

Of course, malware becomes more effective when it infects computers with old or outdated versions of software such as Adobe’s Flash Player, Dark Reading pointed out. But this case shows that malvertising is becoming so sophisticated that businesses should probably go to greater lengths to make sure the methods they use to monetize online content don’t work so efficiently that attackers can go the better part of a month before they’re found out.

More from

FYSA – Adobe Cold Fusion Path Traversal Vulnerability

2 min read - Summary Adobe has released a security bulletin (APSB24-107) addressing an arbitrary file system read vulnerability in ColdFusion, a web application server. The vulnerability, identified as CVE-2024-53961, can be exploited to read arbitrary files on the system, potentially leading to unauthorized access and data exposure. Threat Topography Threat Type: Arbitrary File System Read Industries Impacted: Technology, Software, and Web Development Geolocation: Global Environment Impact: Web servers running ColdFusion 2021 and 2023 are vulnerable Overview X-Force Incident Command is monitoring the disclosure…

What does resilience in the cyber world look like in 2025 and beyond?

6 min read -  Back in 2021, we ran a series called “A Journey in Organizational Resilience.” These issues of this series remain applicable today and, in many cases, are more important than ever, given the rapid changes of the last few years. But the term "resilience" can be difficult to define, and when we define it, we may limit its scope, missing the big picture.In the age of generative artificial intelligence (gen AI), the prevalence of breach data from infostealers and the near-constant…

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today