--- title: Protect Yourself From Ad Threats And 'Malvertising' description: Protect Yourself From Ad Threats And 'Malvertising' --- [![TowerWall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/head-logo-2.svg "TowerWall")](https://towerwall.com/) [![TowerWall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/towerwall-logo-white-test.svg "TowerWall")](https://towerwall.com/) - [Our Partners](https://towerwall.com/how-we-protect-you/our-technology-partners/) - Our Solutions - - Our Cybersecurity Solutions - We operationalize infosec, building security solutions that safeguard your most critical assets. - - [Solutions Overview](https://towerwall.com/cybersecurity-solutions/) - [Risk Assessments & Security Reviews](https://towerwall.com/cybersecurity-solutions/risk-assessments-security-reviews/) - [Program & Policy Development](https://towerwall.com/cybersecurity-solutions/program-policy-development/) - [Incident Response & Remediation](https://towerwall.com/cybersecurity-solutions/incident-response-remediation/) - [Managed Detection & Response](https://towerwall.com/cybersecurity-solutions/managed-detection-response/) - - [Compliance & Privacy](https://towerwall.com/cybersecurity-solutions/compliance-privacy/) - [Comprehensive Security Training](https://towerwall.com/cybersecurity-solutions/comprehensive-security-training/) - [Vulnerability Protection](https://towerwall.com/cybersecurity-solutions/vulnerability-protection/) - [Penetration Testing](https://towerwall.com/cybersecurity-solutions/penetration-testing/) - Virtual Security Officers - - Virtual Security Officer - Leverage the experience and security acumen of Towerwall’s on-demand security experts. - - [Virtual Chief Information Security Officer (VCISO)](https://towerwall.com/virtual-security-officers/virtual-chief-information-security-officer-vciso/) - [Virtual Data Protection Officer (vDPO)](https://towerwall.com/virtual-security-officers/virtual-data-protection-officer-vdpo/) - [Virtual Chief Privacy Officer (vCPO)](https://towerwall.com/virtual-security-officers/virtual-chief-privacy-officer-vcpo/) - We Advise - - We Advise - One-size security solutions only lead to failure. - Industries - [Higher Education](https://towerwall.com/industries/higher-education/) - [Financial Services & Banking](https://towerwall.com/industries/financial-services-banking/) - [Healthcare](https://towerwall.com/industries/healthcare/) - [BioPharma & Bio-Therapeutics](https://towerwall.com/industries/biopharma-bio-therapeutics/) - [Retail](https://towerwall.com/industries/retail/) - [Government](https://towerwall.com/industries/government/) - [Catholic Diocese](https://towerwall.com/industries/catholic-diocese-cybersecurity/) - [Cannabis](https://towerwall.com/industries/cannabis/) - [Small Business](https://towerwall.com/industries/small-business/) - [Enterprise](https://towerwall.com/industries/enterprise/) - Trends & Threats - [Remote Workforce](https://towerwall.com/trends-threats/remote-workforce/) - [Vendor Questionnaire](https://towerwall.com/trends-threats/vendor-questionnaire/) - [HIPAA](https://towerwall.com/trends-threats/hipaa/) - [Ransomware](https://towerwall.com/trends-threats/ransomware/) - [GDPR](https://towerwall.com/trends-threats/gdpr/) - [Cloud Security](https://towerwall.com/trends-threats/cloud-security/) - [Phishing](https://towerwall.com/trends-threats/phishing/) - [Cybersecurity Insurance](https://towerwall.com/trends-threats/cybersecurity-insurance/) - [Resources](https://towerwall.com/resources/) - - Resources - Our latest insights, events, and tools to keep you safe. - - [Insights](https://towerwall.com/resources/?resources_category=MTU%3D&focusarea=0&industries=0&search=) - [Webinars](https://towerwall.com/resources/?resources_category=MTg%3D&focusarea=0&industries=0&search=) - [Whitepapers](https://towerwall.com/resources/?resources_category=MTY%3D&focusarea=0&industries=0&search=) - [View All](https://towerwall.com/resources/) - [Company](https://towerwall.com/company/) - - Our Company - We are the industry’s leading cybersecurity preparedness partner. - - [Who We Are](https://towerwall.com/company/) - [Our Team](https://towerwall.com/company/our-team/) - [Our Approach](https://towerwall.com/our-approach/) - [Our Values](https://towerwall.com/company/our-values/) - - [Awards & Recognition](https://towerwall.com/company/awards-recognition/) - [Certifications & Affiliations](https://towerwall.com/company/certifications-affiliations/) - [Community Involvement](https://towerwall.com/company/community-involvement/) - [Careers](https://towerwall.com/company/careers/) - [Contact Us](https://towerwall.com/company/contact-us/) Topics Malvertising, Ad Threats, Forbes Technology Council, Phishing, PCI, malware, ransomware, HIPAA, COVID-19, cannabis, Enterprise # Protect Yourself From Ad Threats And 'Malvertising' [By Michelle Drolet](https://blog.towerwall.com/author/towerwall2020) [Read More](https://blog.towerwall.com/author/towerwall2020) 3 Minute Read February 03, 2020 Record numbers for internet sales were [reported](https://www.cnbc.com/2019/12/25/reuters-america-corrected-record-online-sales-give-u-s-holiday-shopping-season-a-boost-report.html) in 2019, but online retailers aren’t the only ones laughing all the way to the bank. Cybercrime costs retailers a staggering [$30 billion](https://www.prnewswire.com/il/news-releases/intsights-finds-cybercrime-costs-retailers-30-billion-a-year-300958393.html) a year, and the [sector](https://www.helpnetsecurity.com/2019/10/02/ecrime-campaigns/) is among the top ones targeted globally. Last year, three quarters of global retailers [reported](https://betanews.com/2019/11/15/retailers-cyberattacks/) falling victim to cyberattacks. ### A New Attack Method Emerges: Ad Threats Cyberattackers are constantly evolving and looking for opportunities to deliver malicious payloads to online shoppers. This activity is especially heightened during the shopping season. While several awareness campaigns have been launched this year, one most notably by [Homeland Security](https://www.wsj.com/articles/u-s-cyber-officials-give-holiday-shopping-advice-for-consumers-11574949600) to educate users on making smart and safe shopping choices, the conning of advertisers and publishers into delivering malware-laced advertisements is a growing issue. Ad threats (not to be confused with ad fraud) is a form of so-called  “[malvertising](https://www.forbes.com/sites/forbescommunicationscouncil/2019/05/31/as-malvertising-grows-bolder-publishers-must-step-up-their-defense/#46c7786b2841)” that can involve a JavaScript programming language exploit that thrives off advertisers and publishers who do not monitor their networks or their partners’ third-party code. According to Devcon (via [MediaPost](https://www.mediapost.com/publications/article/345149/ad-threats-becoming-massive-data-security-problem.html)), over 60% of ad threats during the recent holiday shopping period originated from advanced attacks (such as Lucky Star, Invisible Ink, Led Zelpdesk and Avid Diva). Such attacks are usually a combination of [social engineering](https://www.forbes.com/sites/forbestechcouncil/2019/09/09/top-social-media-scams-and-how-to-avoid-them/#7300bbc5873d) and JavaScript exploits that steal credit card information or manipulate shoppers to download a trojan, which could be used to access personal or sensitive information. ### How Ad Threats Work The Devcon report highlighted that hackers can use any of the following methods to exploit advertisers and consumers: **Abusing publisher’s code:** Cybercriminals will create fraudulent accounts with ad networks and use an organization's ad tags to deliver payloads to target websites without even having to compromise the target company’s servers. **Exploiting a partner’s code: **This attack method basically involves exploiting vulnerabilities in the source code of third-party partners that connect with the target website, publisher or advertiser. A similar pattern can be drawn with last year’s [Magecart attacks](https://thehackernews.com/2019/08/magecart-hacking-credit-card.html) that stole credit card information from more than 80 global e-commerce websites that were running an outdated version of the Magento platform. Or take the example of the [eGobbler attack](https://www.technewsworld.com/story/86272.html) that affected more than a billion ads due to a browser flaw on Apple iOS devices. **Exploiting other code vulnerabilities: **If the target company is using third-party JavaScript code or libraries that have vulnerabilities, hackers can exploit them to gain access to credit card information or other personal information. **Infecting JavaScript with malicious code: **Also referred to as steganography, this technique involves embedding the ad creative (image ad or video ad) with a malicious script. Fraudsters can then use these creatives to spread malware across legitimate domains. Per a 2019 [report](https://www.mediapost.com/publications/article/335988/malvertising-found-in-1-in-every-100-ad-impression.html), one instance of malvertising is found in every 100 ad impressions. It is also estimated that malicious ad images alone cost ad networks [more than $1 billion each year](https://www.zdnet.com/article/malicious-code-hidden-in-advert-images-cost-ad-networks-1-13bn-last-year/). ### How Can You Stay Protected From Ad Threats? Service providers and consumers must ensure that they follow these best practices to ensure that they do not fall prey to ad threats. #### Best practices for service providers: - Start with the company culture. Ensure all stakeholders — including employees, suppliers and partners — are aware of the security risks and code is not published without thorough testing. - Have an independent company audit all company code, including third-party integrations, and establish a process to regularly review, monitor and test the code for infections. - Perform regular threat assessments, review integrations and evaluate all security risks. - If budget permits, consider appointing a security advisor, CIO or [virtual CISO](https://www.forbes.com/sites/forbestechcouncil/2019/06/17/passing-the-cybersecurity-baton-to-a-vciso/#787750f43875) to sit on the company board. #### Best practices for consumers and shoppers: - As a rule of thumb, avoid clicking on ads as much as possible — no matter how credible the information might seem. - Verify the legitimacy of the ad. See if the information provided is reasonable and accurate. - Use an effective endpoint/antimalware security solution. Deploy an ad-blocker if necessary. - Keep all software updated. This includes your browser, operating system, antivirus software, Java, Adobe Flash, etc. - In case you are interested in what the ad is offering, search for the company and product directly yourself. If the offer in the ad looks too good to be true, verify it on the company website before clicking on the ad. - Be extremely mindful of phishing pages when filling forms online. - If you come across a suspicious ad, it might be a good idea to report it to the e-commerce website or the ad serving platform.   ### The Future Of Ad Threats The increased amount of money flowing into ad serving platforms is obviously going to attract more and more cybercriminals by the day. While service providers become more security savvy, hackers become more sophisticated than ever before. Understanding ad threats is necessary for staying one step ahead of these fraudsters. [This article was originally posted on the Forbes Technology Council. Click here to read ](https://www.forbes.com/sites/forbestechcouncil/2020/02/03/protect-yourself-from-ad-threats-and-malvertising/#37db995c43d8) #### Protect Yourself From Ad Threats And 'Malvertising' Back to Top ## Related Insights ### [A Cybersecurity Checklist For The New Norm](https://blog.towerwall.com/a-cybersecurity-checklist-for-the-new-norm) Malvertising, Ad Threats, Forbes Technology Council, Phishing, PCI, malware, ransomware, HIPAA, COVID-19, cannabis, Enterprise ![Escalating Cyberattacks on Healthcare Organizations Highlight Need for Security Interventions](https://blog.towerwall.com/hubfs/Imported_Blog_Media/PenTestService-Card-2.jpg) ### [Escalating Cyberattacks on Healthcare Organizations Highlight Need for Security Interventions](https://blog.towerwall.com/escalating-cyberattacks-on-healthcare-organizations-highlight-need-for-security-interventions) Malvertising, Ad Threats, Forbes Technology Council, Phishing, PCI, malware, ransomware, HIPAA, COVID-19, cannabis, Enterprise [View All Insights](https://blog.towerwall.com) × ## Talk with us now about: #### Your security needs. - ![Phone](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/phone-icon.svg "Phone") [Call 774.204.0700](tel:774.204.0700) - ![Mail](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/mail-icon.svg "Mail") [Email Us](mailto:info@towerwall.com) ### The front line of cybersecurity.™ For over 23 years, Towerwall, a woman-owned business, has helped scores of companies safeguard their data and leverage their investment in IT with advanced information security technology solutions and services. Our experience in all facets of information security coupled with serving in the CIO/CISO/ISO roles provides a unique first-hand understanding of the security challenges organizations face daily. ### Connect - - - - - [Career Opportunities](https://towerwall.com/company/careers/) - [Contact Us](https://towerwall.com/company/contact-us/) © Towerwall, Inc. and its licensees. All rights reserved [Privacy Policy](http://towerwall.com/privacy-policy/) Sitemap [Created by Howbridge](https://meethowbridge.com/) [![Towerwall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/footer-logo.svg "Towerwall")](https://towerwall.com/)