The digital impersonators: How cybercriminals hijack your brand to launch malvertising attacks

Brand trust is a currency more valuable than gold – consumers click on links bearing familiar logos with an almost reflexive sense of security. And it is this hard-earned trust that cybercriminals systematically seek to counterfeit – your brand name (whether you’re a tech giant, a software developer, or just a trusted outlet) is being literally weaponized.

The weapon of choice is the malvertising.

Or, a malicious advertising.

This is a campaign that uses the infrastructure of legitimate online advertising in order to deliver malware, often by impersonating the brands we know and rely on.

Read on, and we will tell you everything about brand protection – we will explain all the mechanisms of malvertising, so you understand how all this works and how to shield yourself.

What is malvertising exactly, and why your brand?

’Malvertising’ involves injecting malicious code into legitimate advertising networks and websites. These very ads are then displayed to users, often on highly reputable sites. When clicked (or sometimes even just viewed), they trigger a cascade of events: first, redirecting user to phishing site(-s), and second, launching exploit kits that probe for software vulnerabilities, or silently downloading ransomware, spyware, banking trojans.

The cybercriminal’s calculus is simple here:

Why build trust from scratch when you can just steal it?

By cloaking the attacks in brand’s identity, they achieve instant credibility – they target brands that align with common user needs and high-traffic moments:

• Software and tech giants – brands like Google and Microsoft are perennial favorites. Ads promising some ’free Office cracks’ prey on thoose seeking common software.
• Media and streaming services – fake ads for exclusive videos or ’freemium’ access to streaming platforms generate clicks from curious or eager ones – and, truth be told, with dramatical ease.
• Financial Institutions – while somewhat guarded, impersonation attempts for banks or payment processors are still highly lucrative.

The mechanics of a brand-impersonating campaign

The steps involved reveal a chilling efficiency. Yet, to improve security, we need to understand exactly how this all work.

First, the setup

Criminals either create fake digital advertising accounts using stolen credit cards or compromise legitimate ones. They then submit clean ads initially – just to pass review processes conducted by ad networks. Once the account is trusted, they switch the ad creative to the malicious version instead.

Second, the bait

This is where the brand is plundered: attackers create ads that are pixel-perfect replicas of the official branding: logos, colors, fonts, and sometimes, even value propositions.

And the copy is both urgent and compelling.

Say, it may promote a fake critical security update for a widely-used software, a sensationalist story, or just an unbelievably steep discount on some branded goods.

The whole psychological hook is designed to bypass cautious reflection, thus prompting an immediate click. In a nutshell, this is where the hijacking is complete – brand’s identity has funneled the user towards the trap.

Third, the distribution

Using the compromised ad network account, criminals purchase ad space. Through real-time bidding, their malicious ad can instantly appear on hundreds of legitimate, high-traffic news sites, blogs, video platforms. The user sees an ad on a site they trust, for a product they trust, and clicks.

Sure thing, it should be clarified that the mechanism isn’t used only for such harmful purposes. In fact, quite the opposite is true. And since we’re discussing the actual topic, it makes sense to delve into it in more detail – to skip it would be a missed opportunity. So, for advertisers, RTB is a powerful model – unlike the traditional one, which auctions off ad space, real-time bidding focuses on displaying ads to specific users based on their interests. That said, with proper targeting, advertisers can reach their ideal audience with precision. Overall, the Amazon team provided an exceptionally clear explanation of the process, more thorough than we can cover here and now. For detailes, you can refer to their guide.

Fourth, the payload

The click is a mere beginning.

The ad typically doesn’t deliver malware directly.

Instead, it redirects the user through a series of intermediary servers (so-called ’redirect chain’) designed to obscure the final destination. And this journey often ends at an ’exploit kit’ landing page.

Fifth, the infection

The exploit kit scans the visitor’s browser, plugins, and operating system – for unpatched vulnerabilities. If it finds one, it exploits it to download and execute the final malware payload – all without the user’s knowledge. If no vulnerability is found, the user might be redirected to a convincing phishing page or a page filled with some scammy downloads.

The possible consequences for all parties

The damage radiates outward, therefore creating a cascade of victims:

• For the consumer – the end-user suffers direct harm – this can mean identity theft, financial loss from ransomware/banking trojans or a a hijacked system for botnet activities. What’s more, their trust in the digital landscape is eroded for, like, eternity.
• For the brand – the repercussions are severe, yet often indirect. For example, the help desks may be flooded with confused and angry users reporting issues caused by the fake ads right after. On top of everything, some security companies may begin publishing alerts about scams using your brand name. Lastly, in regulated industries, failing to proactively protect your brand from being used in fraud can have implications.

How to shield the brand of yours

Protecting your brand from abuse requires a proactive, multi-layered defense strategy.

Ensure regular software updates

Timely software updates are the cornerstone.

Criminals routinely exploit known vulnerabilities in outdated operating systems, applications, and browsers. That said, implementing an automated patch management strategy (be it handled internally or by a trusted provider) closes the ’gaps’ way before they can even be attacked.

Train your team continuously

The human factor is often the first line of defense.

So, a regular (and a proper one) cybersecurity training equips employees with essential cyber ’hygiene’ principles – staff should learn to identify suspicious ads, avoid clicking on unverified links, and report all the unusual activity.

Deploy some protective tools

Corporate-grade ad blockers act as an first barrier (and the effective one), significantly reducing exposure to malicious content. These should be integrated into a security strategy that do also includes antivirus software, endpoint detection and response systems, and real-time threat monitoring.

There’s a prevailing misconception that antivirus products are redundant. The opinion, while not entirely unfounded, is really only relevant for home systems. For corporate networks, antivirus software continues to serve as an important protective measure. And given the sheer number of solutions on the market, selecting the right one can be challenging. During our research, we evaluated some options and concluded that this ’Best Antivirus’ ranking by PC Mag is one of the most objective and credible out there.

Partner with a managed service provider

For many organizations, combating threats do require some dedicated expertise.

Some thing called ’MSP’.

An MSP provides protection that extends way beyond basic tools:

• Proactive patch-management – the MSP monitors, tests, and automates updates across the entire infrastructure, minimizing downtime and neutralizing vulnerabilities.
• 24/7 monitoring and response – specialists continuously monitor network activity in order to identify anomalies, intercept threats, and initiate rapid response procedures to limit damage and restore operations.
• Ongoing security training – MSPs may also facilitate regular and up-to-date training sessions just to keep employees vigilant against new attack methods, including malvertising campaigns.

Stay tuned on evolving threats

The cyber threat landscape is dynamic.

And that’s putting it just mildly.

Social engineering and zero-day vulnerabilities demand that defense strategies continually adapt – a strong security posture should include regular assessments, network segmentation, a Zero Trust architecture, and advanced email and web filtering.

Featured image credit