Threat Spotlight: Malvertising — When the Top Search Result Is the Trap

Ask most people how they reach their bank, their accounting software or a program download, and the answer is "I Google it and click the top link." Criminals noticed. Malvertising — buying search ads that impersonate legitimate brands — and SEO poisoning put attacker-controlled pages above the genuine article, delivering fake installers laced with info-stealers or pixel-perfect fake login pages.

How the scheme runs

• The attacker buys ads for terms like "[popular tool] download" or "[bank] login", often using lookalike domains a character off the real one.
• Cloaking shows the ad network a clean page while victims get the malicious one, slowing takedowns.
• Fake installer downloads bundle info-stealer malware; fake login pages harvest credentials in real time.
• Weeks later, the harvested access resurfaces as invoice fraud or a ransomware foothold — the connection to a search ad long forgotten.

Why businesses fall for it

Because it exploits a habit that used to be safe advice. Staff hunting for a PDF converter, a driver, or a portal they use quarterly are moving fast and trusting the search engine to have vetted the results. Ads are labelled, but subtly — and the lookalike domains are chosen to survive a glance.

Breaking the habit safely

• Bookmark the front doors: banking, accounting, payroll and key portals get bookmarks, not searches.
• Software comes from vendor sites or managed deployment — never from a search ad, ideally never self-installed at all.
• Application control or restricted admin rights, so a rogue installer can’t simply run.
• DNS-level filtering that blocks known malicious domains adds a quiet safety net for the whole office.
• EDR for the times an installer runs anyway — stealer behaviour is loud to the right sensor.

The search engine is a marketplace, not a safety authority. Teach the bookmark habit and take installation out of daily users’ hands — two small changes that close a very modern door.