Academy
TermAttack

Malvertising

Taking the user to a fake download page with ads bought on search engines and ad networks.

Flow

  1. 1Ad bought
  2. 2Fake page opens
  3. 3File downloaded
Related families
Atomic macOS Stealer (AMOS), Poseidon Stealer
MITRE ATT&CK
T1583.008 · Malvertising
Sources
7 sources
01

Overview

The attacker places an ad that appears at the top for users searching for a well-known piece of software. The ad leads to a page resembling the real site, and the installer downloaded from there contains malware. MITRE ATT&CK

The user does not suspect anything because they think they are downloading the program they searched for; email security does not see this path either. Malwarebytes

02

How it works

  1. 1

    Ad bought

    A search ad is placed under the name of popular software. MITRE ATT&CK

  2. 2

    Fake page opens

    The ad redirects to a page imitating the vendor’s site. MITRE ATT&CK

  3. 3

    File downloaded

    The user runs the installer; the malware is installed. MITRE ATT&CK

03

Real-world examples

04

How to detect it

  • An installer being downloaded from a similarly named or newly registered domain instead of the vendor’s domain. MITRE ATT&CK
05

What to do

  • Restrict software installation to the corporate software center. MITRE ATT&CK
  • Use ad blocking and web filtering on the corporate network. MITRE ATT&CK
06

MITRE ATT&CK

T1583.008MalvertisingT1189Drive-by CompromiseT1204.002User Execution: Malicious File
07

Related families and terms

Families

Atomic macOS Stealer (AMOS)ActivePoseidon StealerActive

Report

Infostealer Threat Report — October 2026

Terms

TyposquattingJoinerGreyware
08

Sources

  1. 1Malvertising (T1583.008) · MITRE ATT&CK
  2. 2Drive-by Compromise (T1189) · MITRE ATT&CK
  3. 3User Execution: Malicious File (T1204.002) · MITRE ATT&CK
  4. 4Atomic macOS Stealer delivered via malvertising · Malwarebytes, 2023
  5. 5Poseidon Mac stealer distributed via Google ads · Malwarebytes, 2024
  6. 6Behavior Prevention on Endpoint (M1040) · MITRE ATT&CK
  7. 7Restrict Web-Based Content (M1021) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans