The battle against malicious ads is ongoing, as we continue to come across new hurdles with evolving software, evasive techniques and sophisticated malware. It seems never ending, and unfortunately, it is.

The expansion of our digital presence also means more opportunities for fraudsters to take advantage of updates and weak spots in our systems. As if business didn’t already have enough on their plates with limited budgets and ever-changing goals, you also need to combat new threats, diverting more resources in the process.

But it’s not all doom and gloom. Once you know your enemy, you can plan how you’re going to fight back. So, we’ve compiled the top five malware trends we’ve detected for 2022 to help you protect your brand, stakeholders, partners, and consumers. 

1) Redirects have reemerged

Redirects were quiet for part of last year, but reemerged at the beginning of this year. In particular, our team spotted a spike in ad campaigns with forceful automatic redirections that look like anti-virus companies such as McAfee, and actively look for anti-malvertising vendors.

Unfortunately, the malicious actors have continued to build out more sophisticated tactics, including obfuscation, steganography, detecting the presence of ad quality vendors, and device fingerprinting. More recently, we're even seeing that they’re sophisticated enough to collect metrics about the environments they appear on.

Typically difficult to detect, redirects may not be visible until after the fact, when you get communications from visitors who were scammed or infected with malware. Between search engine blacklisting and a damaged reputation becoming an unsafe site for visitors, malicious redirects can do serious damage to your business.

You can read more about the threat of redirects and their use of malicious code in our Active Threats article.

2) Misinformation ads are on the rise

Unsurprisingly, we’ll see another increase in misinformation ads due to high-profile events, including the Russia/Ukraine crisis and the mid-term elections coming up. In their 2021 Social Impact Report, NewsGuard reported that "top brands are inadvertently sending $2.6 billion to misinformation publishers each year through digital marketing campaigns."

‍Misinformation ads not only waste your already stretched budgets and damage your brand, they can have catastrophic consequences with far reaching and long-lasting ripple effects. We saw this in 2021 with misinformation about the COVID-19 vaccine and the 2020 Presidential Election, which led to the storming of the US Capitol.

Stopping, or limiting, misinformation ads is not just the safe thing to do to protect your revenue, relationships, and reputation, but your moral obligation to protect others from potential harm.

3) Adult Ads

Another type of ad we’ve seen an increase of are seemingly benign marketplaces, like Redbubble, use highly offensive adult content to drive clicks and awareness of their sites. Since Q3 2021, we’ve seen 41M blocks of these ads, impacting 7208 domains.

While these ads are not necessarily malware, we see them using techniques to evade being blocked, such as changing or obfuscating their domains. These techniques allow them to evade SSP blocks, since their top level domain is often not adult content, but the images in the ads are, and SSPs rely on declared domains to block advertisers.  

As a publisher, imagine the damage that could be done by displaying an ad of adult nature to younger visitors, or simply visitors not expecting to see this type of content on your site. This creates a bad user experience and damages your relationship with those visitors (who will be less likely to return to your site) and your business reputation by association with those ads. 

Now that basic ad blocking is no longer adequate security, these sneaky evaders make ad quality products such as Ad Lightning from Boltive even more important. Because we can see more than just the domain, we can stop the creative in its tracks and protect you and your visitors.

4) Cyber attacks are inevitable

Adjacent to digital advertising is the risk of cyber attacks following world events, in particular Russia’s invasion of Ukraine. If there are Russian cyber attacks on U.S. institutions, they will almost certainly include corporations, including the media. The chance those attacks—however unintentional—bleed over to the digital advertising industry is nearly certain.

In March, President Biden warned the country that “based on evolving intelligence, Russia may be planning a cyberattack against us.” He told the Business Rountable that "[T]he magnitude of Russia’s cyber capacity is fairly consequential, and it’s coming" and suggested that "[I]t's a patriotic obligation for you to invest as much as you can in making sure... you have built up your technological capacity to deal... with cyberattacks."

Revisit and regularly audit the security procedures of your own systems, such as firewall protection and anti-virus software, as well as those with your data partners, to ensure you are as secure as possible. 

Don’t forget that in the world of digital advertising, where data is passed back and forth between many hands, you can’t rely on one-off checks, because the actions of your partners (and their partners!) affect you too. You are only as strong as your weakest link and you need to be auditing your stack regularly.

5) Data privacy laws are evolving

The countdown is on to new privacy laws going live in 2023, which means we'll see a shift in attention back to privacy and audit tools. California's CPRA, Virginia's VCDPA, and Colorado's CPA will all go live next year, and businesses are already preparing for their arrival.

As the data privacy landscape continues to evolve, so will data privacy laws. California has recently added audits of your third parties to draft rules that take effect next year.

Regularly auditing your privacy programs is a must, which includes auditing your data partners to ensure your consumer’s data is safe even once it crosses hands and avoid regulatory action. Key areas of concern:

1. Consumer opt outs are being accurately recorded by the business’s privacy technology (ex. CMP)
2. Consumer opt outs are being accurately transmitted to the business’s service providers (ex. Ad platforms)
3. The business’s service providers are not sharing consumer personal data with unauthorized third parties

To do this, you need a tool that gathers data points that identify unauthorized sharing and where the mishandled consent is coming from. With this information, you can stop it and get accountability from those partners if something goes wrong.  It also creates a “good faith” audit trail that regulators like to see.

You can do exactly this with The Boltive Risk Index (BRI™), a feature of Privacy Guard™, which quantifies your exposure by scoring your ads, partners, data collectors, and user segments to show if your partners' data practices are violative and putting you at risk of regulatory action. 

The easy way to stay on top of malware threats

Our research team is constantly on the lookout for new and emerging threats that could harm your business. We regularly update our Active Threats page with all the need-to-know information, so you can get back to other important tasks that move your business forward.

Schedule a Privacy Guard Demo