Malvertising means malicious advertising. A harmful ad can appear through normal ad networks on search results, websites, and free apps, even when the site itself is legitimate.
Does this affect you?
Use this for Windows, Mac, iPhone, and Android when an ad, popup, fake warning, or download button makes you worry something unsafe happened.
Recognize it and reduce your risk
You cannot fully control which ads appear, but you can make them less dangerous.
- Watch for fake system warnings such as your computer is infected, click to clean, or virus detected. Real security alerts do not come from website ads.
- Do not click Update or Download buttons inside ads. Update software from the app itself, the operating system, or the official website.
- Use browser popup blocking, built-in tracking protection, or a reputable ad blocker. Firefox and Brave support strong options such as uBlock Origin; Chrome users may see newer limited variants such as uBlock Origin Lite depending on extension support.
- Keep the browser and operating system updated because many malicious ads depend on old vulnerabilities.
- Be extra cautious on free streaming, pirated media, cracked software, file converter, and free VPN sites because they often use lower-quality ad networks.
- If a popup traps the browser, force-close the tab or app instead of clicking buttons inside the popup.
If you already clicked
The response depends on what happened next.
- If a file downloaded but was not opened, delete it from Downloads.
- If you ran the file, run a full security scan right away.
- If you entered a password, payment card, phone number, or personal information, treat it like phishing: change passwords and contact the card issuer if needed.
- If popups keep returning after the page is closed, reset the browser and remove unfamiliar extensions.
- Report the malicious ad if the website, search engine, or ad network provides a report option.
More control
Ad supply chains are complicated
A website can use an ad network that resells space through other exchanges. A malicious ad can enter the chain without the site owner directly approving it.
Mobile apps can show malvertising too
Free games and apps may display fake warning-style ads. Treat those like browser ads: do not install updates or security tools from inside the ad.
The site may not be hacked
A legitimate site can have safe editorial content and a compromised ad slot at the same time.
Sources
- CISA – Malvertising (2025)
- Google Ads Safety Report (2025)
- FTC Consumer Advice – Malware (2025)