What is malvertising? Why clicking search ads can lead to malware

What is malvertising? It is malicious advertising: paid ads, usually at the top of search results, that send people to fake sites built to steal a login or deliver malware. We have seen it at our own clients, and it nearly always starts the same way, with someone searching for a tool they need and clicking the first result.

The FBI has been warning about it for years. It shows up in search results, on social media and on ordinary websites, and it doesn’t need to target you. It only needs one person on your team to be in a hurry.

What it looks like in a real office

Someone needs a PDF editor, so they search for it. The top result is a sponsored ad that looks just like the vendor’s site, and the installer has the right name. It also carries an infostealer that copies saved browser passwords and session cookies, which can let an attacker into email without ever needing the password again.

The same approach shows up in other forms:

• Ads that impersonate banks, payroll providers, health savings accounts and Microsoft 365 sign-in pages lead to fake login pages. In late 2025 the FBI warned that criminals buy ads imitating financial institutions so their phishing sites look more authentic in search results, a technique it calls SEO poisoning.
• Some ads list a fake support number. The person who answers walks you through “fixing” your account, which really means handing over your login, your MFA code or remote access to your computer.
• Malicious ads also run on ordinary websites. Microsoft Threat Intelligence tracked a campaign starting in December 2024 that began on illegal streaming sites, bounced visitors through a chain of redirects, and affected nearly one million devices worldwide, including business computers.

What is malvertising doing in your search results

The FBI describes the most common version: criminals buy search ads using a domain that looks like a real business. When someone searches for that business, the fake ad appears at the very top of the results, with minimal distinction between the ad and the real listing.

Search engines label ads with words like “Sponsored”, but the label is small and easy to scroll past, especially on a phone. The ad may show the real company’s name and a web address that is a letter or two off. Remote staff are often the most exposed, because they search for tools on their own, sometimes on personal devices without company filtering.

Warning signs before you click or sign in

• The result is labeled sponsored and you were looking for a login, a download or a support number.
• The address bar shows a misspelling, an extra word or an unfamiliar ending after you click.
• A download page offers a “free” version of paid software.
• Your password manager doesn’t offer to fill your login, which usually means you are on the wrong site.
• A support agent asks for an MFA code or wants to connect to your computer.

Habits and controls that stop it

A few habits close most of the gap. Bookmark anything that involves a login or money, including banking, payroll, tax portals and Microsoft 365, which is exactly what the FBI recommends. Scroll past sponsored results or type the address yourself. Get software from the vendor’s official site or through IT, and find support numbers on your statement or the back of your card. Never share an MFA code with anyone who calls you.

At the business level, these controls stop a bad click from turning into an incident:

• DNS and web filtering that blocks known malicious and newly registered domains.
• Ad blocking in managed browsers, which the FBI suggests for searching.
• Application control, so only approved software runs, even after a fake installer is downloaded.
• No local admin rights for everyday users.
• Endpoint detection and response watched around the clock. Every one of our clients has a 24/7 security operations center that can isolate an infected device.
• Phishing-resistant MFA and conditional access, which make stolen passwords far less useful. See our guide to passwords and authentication.
• A business password manager that only fills credentials on the real site. Our post on how password managers work explains how autofill flags a lookalike page.

If someone already clicked

1. If a download ran, disconnect the computer from the network and leave it on.
2. Stop entering passwords on that device.
3. Call IT right away. Minutes matter.
4. Change passwords from a clean device, starting with email and anything saved in the browser, and sign out of all sessions.
5. If banking or payroll details were entered, call the bank’s fraud line from a number you already have.

The FBI also advises businesses to use domain monitoring, so you are alerted when lookalike versions of your own domain are registered and your clients can be targeted with ads impersonating you. These layers are part of our cybersecurity services and managed IT services, and our overview of types of malware covers what fake downloads usually install.

Application control and admin rights decide whether a fake installer can run on your computers. Book a 15-minute call and we’ll check yours with you.

Related reading: Business email compromise: How it works and how to stop it, How to prevent a data breach: 10 steps for small businesses and What is password spraying? How it works and how to stop it.

Frequently asked questions

What is malvertising?

Malvertising is malicious advertising: paid ads, usually at the top of search results, that send people to fake sites built to steal a login or install malware. A common version is a sponsored result for a PDF editor or a bank login that looks just like the real site. It also runs on social media and ordinary websites.

How do you prevent malvertising?

Bookmark anything that involves a login or money, scroll past sponsored results, and get software from the vendor’s site or through IT. At the business level, DNS and web filtering, ad blocking in managed browsers, application control and no local admin rights stop a bad click from turning into an incident. The FBI recommends using an ad blocker for searches.

How does malvertising work?

Criminals buy search ads on a domain that looks like a real business, so the fake ad shows up at the top when someone searches for that business. The small Sponsored label is easy to miss, especially on a phone. The site behind the ad either captures the login typed into it or offers an installer carrying an infostealer, which copies saved passwords and session cookies.