Loading story…
The Media Trust’s Global Report on Digital Trust, Ad Integrity, and the Protection of People warns that malvertising is increasingly delivered through the same infrastructure used for legitimate online advertising, with scam campaigns, malicious redirects, and malware distribution blending into normal marketing traffic. The report estimates combined US consumer and business losses tied to malware, scams, and ad-borne fraud exceeded $12.5B in 2025, and notes broad exposure, with 7 in 10 adults reporting a digital scam or phishing attempt in the prior 12 months.
Reporting on the same findings, Business Insider said programmatic advertising overtook email scams and direct hacks as the primary malware channel in 2025, with advertising accounting for 60%+ of observed malware and phishing campaigns and year-over-year growth in programmatic-delivered malware of roughly 45% (with Help Net Security citing a 42% malvertising increase). The report highlights how the scale of automated ad buying and the expanding adtech supply chain allow a compromised creative or redirect script to propagate widely across websites, apps, streaming/connected TV, and other channels, while AI-generated content is increasingly used for brand impersonation and deceptive ads (including deepfake-style lures).
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
In early March 2026, The Media Trust released its Global Report on Digital Trust, Ad Integrity, and the Protection of People, detailing the rise of malvertising, AI-enabled impersonation, and ad-supply-chain abuse. The report also tied these trends to major financial losses and called for stronger consumer, industry, regulatory, and law-enforcement responses.
Based on its 2025 observations, The Media Trust concluded that malicious online advertising surpassed email scams and direct hacking as the primary malware delivery channel. The shift was attributed to the scale and complexity of the programmatic advertising ecosystem and its expansion into channels like connected TV and retail media.
The Media Trust found that in 2025, 63% of detected brand-impersonation ads used AI-generated imagery or text, including deepfake-style lures. The report described AI-enabled ad creation as making scams easier to scale and target at vulnerable users.
During 2025, The Media Trust observed the GhostCat redirect malware campaign appearing across 48 advertising networks. The example illustrated how malicious code could propagate widely through the adtech supply chain.
The Media Trust reported that malware delivered through programmatic advertising grew sharply in 2025, with ad-borne malware and phishing accounting for more than 60% of the campaigns it tracked. Malvertising incidents rose roughly 42% to 45% year over year, making online advertising a leading delivery channel for scams, redirects, and malware.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly exploiting social media and video platforms such as Facebook and YouTube to distribute scam advertisements, deepfakes, and malware. Former Meta executives have launched a nonprofit initiative to address the growing lack of transparency and stagnation in anti-scam ad technology, highlighting the persistent evolution of scam tactics and the use of AI to create convincing fraudulent content. Meanwhile, YouTube faces a surge in scams and malware campaigns, with attackers leveraging the platform’s recommendation algorithms, hijacked accounts, and AI-generated videos to reach wide audiences. Notable operations include the "YouTube Ghost Network," which used thousands of videos on compromised channels to lure users into downloading malware or visiting phishing sites, and scams that migrated from Facebook Ads to YouTube and Google Ads, exploiting trusted brands and hijacked ad accounts. The sophistication of these scams is amplified by the use of deepfakes and synthetic identities, making it increasingly difficult for both users and traditional moderation systems to detect fraudulent activity. Security researchers emphasize the need for advanced detection technologies, such as light spectrum analysis and cryptographic verification, to combat these threats. The ongoing arms race between scammers and platform defenders underscores the urgent need for industry-wide improvements in transparency, technology investment, and layered verification standards to restore trust in online advertising and content platforms.
Jun 29, 2026
Threat actors are increasingly leveraging fake websites and bogus software installers to distribute malware, employing advanced techniques such as AI-generated web pages and code-signed malicious applications. One campaign involves the use of the legitimate Syncro remote access tool, where attackers create their own signed builds and distribute them via mass-generated, AI-powered fake websites that closely mimic official application sites. These malicious sites are promoted through search engine optimization and phishing emails, often masquerading as trusted brands like antivirus or password management tools, to trick users into downloading malware-laden installers. Another ongoing global campaign, dubbed TamperedChef, uses counterfeit installers for popular software to deliver JavaScript-based remote access malware. The attackers utilize malvertising, SEO, and abused digital certificates from shell companies to increase the credibility of their malicious payloads. The infrastructure supporting these campaigns is described as industrialized, with operators regularly acquiring new code-signing certificates to evade detection. Both campaigns highlight the growing sophistication and scale of malvertising operations targeting users through deceptive download sites and installer packages.
Jun 29, 2026
Threat actors are increasingly using **trusted platforms**—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a **three-step malvertising chain** delivered via **Facebook paid ads** that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a **tech support scam (TSS) kit** hosted on **Microsoft Azure** infrastructure (including `web.core.windows.net`). Researchers reported rapid infrastructure churn, with **100+ domains rotated in seven days**, and targeting focused on **U.S. users** with activity concentrated on weekdays. Parallel enterprise-focused campaigns are hosting phishing infrastructure on **Microsoft Azure Blob Storage**, **Google Firebase**, and **AWS CloudFront**, using **redirect chains, CAPTCHA gates, and QR codes** to bypass automated analysis and email defenses. Analysis highlighted the use of **Adversary-in-the-Middle (AiTM)** phishing-as-a-service kits—**Tycoon2FA**, **Sneaky2FA**, and **EvilProxy**—to steal credentials and **session tokens** even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal **Dropbox** credentials: benign-looking procurement-themed emails deliver **PDF attachments** that hide clickable elements (e.g., via *AcroForms* and `FlateDecode`), which then route victims to a second-stage file hosted on **Vercel Blob** and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).
Jun 29, 2026