Unfamiliar with the term, malvertising is a coined word that describes a growing online practice involving embedded malware, and malicious software attached to company and individual webpages, social media sites, photographs, illustrations, charts, download links, and online advertising. Click on any of this content with malware aboard and your phone, tablet or PC becomes infected.

Since online advertising is big business worth hundreds of billions of dollars annually, malicious online actors happily take advantage of user interest in what is being sold and make content that deceptively entraps you.

You may be familiar with the term phishing. Malvertising is similar and may be combined with phishing in a targeted attack. But I will leave Egline to tell you more and how you can protect yourself from malicious online threats. As always, your comments and questions are welcome.

Have you ever clicked on an online ad that led you somewhere you didn’t expect? That might have been malvertising, where hackers hide malicious code within seemingly harmless ads. It’s more common than you might think. A recent study found that 777 million users may have been exposed to unsafe ads. 

Now, attacks are everywhere, on news sites, gaming pages, and even places you usually trust. One wrong mouse click can infect your devices with viruses or spyware. So before you unknowingly contribute to the statistics, let’s explore malvertising and the simple steps you can take to protect yourself. 

How Malvertising Works

Malware is bad software that nobody wants. Bad actors on the Internet embed it into online content and in malvertising into ads specifically. The ads are designed to do more than just sell you something. They secretly install harmful software on your computer or phone. 

Let’s talk about a few ways hackers use malvertising to mess with you:

• Drive-by Downloads – This happens when you visit a website and, without clicking anything, a malicious program starts downloading to your device. 
• Redirects to Malicious Sites – Sometimes, clicking on an ad doesn’t take you to where you expect. Instead, you end up at a website that looks real but is controlled by hackers. These sites can trick you into giving away personal information or downloading more malware.
• Exploit Kits – These are tools that hackers use to take advantage of weaknesses in your browser. By targeting these vulnerabilities, hackers can inject malware without much effort.

The Damage Malvertising Can Do

Malvertising can cause a lot of trouble. Here’s how it impacts you and what to look for:

• Data Theft – Malicious ads often try to steal your personal information. This could be anything from passwords and email addresses to more sensitive data like bank account details. Once cybercriminals have this information, they can use it to steal your money or even your identity.

• Unauthorized Use of Resources – Some malware turns your device into a part of a botnet. Botnets are networks of private computers infected with malicious software controlled by malicious online actors. This means your computer or phone can be used to send spam or attack other systems without your knowledge.

Now, how do you tell if you’ve been hit by malvertising? Well, your device starts running slower than usual. And you may notice apps or programs that you didn’t install.

How to Protect Yourself from Malvertising

Here’s a closer look at each step you can take to guard against malvertising threats:

Ad Blockers

One of the most effective ways to shield yourself from malvertising is to use ad blockers. They help keep sneaky, harmful ads at bay, making your browsing safer. 

One well-known ad blocker is uBlock Origin. It’s a strong choice for many users because it’s efficient at blocking unwanted ads. However, if you’re using a Mac, uBlock Origin for Safari is unavailable. Don’t worry; there are other options available to Safari users.

A good alternative is AdLock. It’s designed to block ads and protect you from malicious websites, much like uBlock Origin. This powerful tool also shields you from other online snoops that can invade your privacy and security.

Software Updates

One of the simplest defences against malvertising is keeping your software up to date. This includes everything from your operating system and web browser to smaller plugins like Adobe Flash or Java. 

Developers regularly release updates that fix security vulnerabilities. Ignoring update notifications can leave you open to attacks that exploit old weaknesses. So, make it a habit to install updates as soon as they become available, or set your devices to update automatically.

Antivirus and Anti-Malware

Even with careful practices, some threats might slip through. That’s where antivirus and anti-malware software come in. These tools provide real-time protection by scanning and blocking malicious programs before they can do any harm. 

So, make sure that your antivirus software is set to update automatically to protect against the newest threats. And don’t forget to conduct regular full-system scans. This practice can catch anything that might have slipped past the real-time shield.

User Awareness

The most critical tool in your arsenal is your awareness. Malvertisers often rely on deception, ads that look legitimate but lead to harmful sites or offer incredible deals that simply are too good to be true. 

That’s why educating yourself on the common signs of suspicious ads, such as poor spelling, unprofessional visuals, or offers that require unnecessary personal information is essential. Always be cautious when clicking on ads, even on trusted sites, as cybercriminals can infiltrate even the most reputable ad networks.

That’s a Wrap

Malvertising is dangerous. Remember, you have the power to fight back against it! Stay alert, be suspicious of strange ads, and keep your software up-to-date. Always think twice before clicking on ads, and keep your devices secure. Stay safe out there!

1. You get a Facebook, Instagram, X, or WhatsApp message from a friend stating his or her wallet and identification were lost or stolen while on a trip. That means no passport, money, credit cards, airline tickets, and an outstanding hotel bill to settle. The friend asks you to wire money.
2. You get a telephone call, text message, or email from a business you deal with where you have an account claiming suspicious activity has been detected. You are asked to call a number or click on a link.
3. You have a package being held at the post office, or at customs claiming there is contraband or suspicious material within it. You are asked to call back and provide personal information.
4. You get an emergency call from a family member. They have been in an accident or been arrested. The family member puts another person on the line to advise you on what to do.
5. You get a customer support call about detected viruses or malware on your computer and the person asks you to turn it on and give them access to remove it.
6. You get a call from a government agency like the IRS in the U.S., or CRA in Canada. You or your partner owe unpaid taxes. The caller asks for personal financial information.

I don’t know if I have exhausted the list but I have received all of these scam, phishing and attempted fraud enquiries in the past forty years.

The one I remember most was a caller who identified himself as an agent of Revenue Canada claiming my wife’s tax filing was incorrect. She owed the government $1,200 in unpaid taxes. I was asked to share information from her latest tax return. I asked the agent to tell me my wife’s full name and current address. He got the name right (which was disturbing) but the address wrong. I told the caller his information was incorrect. He said he would review the file and get back to me. Of course, he never did.

Scams and Artificial Intelligence (AI)

Everything I previously have described about illegal activity by online fraudsters and scammers will receive more than just a fresh coat of paint when scammers harness the power of AI to their fraudulent schemes.

How will you trust that the person speaking to you on the phone is a relative in trouble or a cloned voice? The family emergency scam takes on a whole new meaning. Not only can the scammer do a voice clone, but they may even capture the mannerisms and speech patterns of a family member from a YouTube, Snapchat, or TikTok video and use it to fool you.

How will you know that a text or email message received is not AI-generated fakery? How will you know that you are talking to a real person or will it be a chatbot impersonating a customer representative from your bank, or the tax department? When the chatbot asks for personal information like date of birth, and social insurance (social security) number to verify your identity, you will have opened yourself to having not just money stolen, but your identity as well.

Protecting You From AI Scammers

Here are 8 general rules to combat scammers whether they are a person or an AI:

1. Don’t engage in conversations with strangers online or on the telephone.
2. Don’t post personal information about you or family members on any social media site if this is information that you feel could compromise you in the future.
3. If you get an unsolicited message whether by phone, text, email, or social media site, proceed with caution.
4. If a family member calls in distress, ask for a callback number. Before calling it, call the person’s home or mobile phone. They may be sitting at home reading a book.
5. Don’t share any security information. Don’t share any financial information. Don’t share any passwords. In other words, don’t share anything that can be copied or cloned unless you know with whom you are speaking or interacting online.
6. Businesses today use multifactor authentication to protect themselves. You should too when accessing your online applications and sites.
7. A single-sign-on tool that auto-generates passwords is a better way to secure your online presence so that you don’t end up using the same password repeatedly for logins.
8. Keep the security on all your devices up to date.

We increasingly rely on our smartphones and the digital economy to manage our money. Between the App Store and Google Play, with approximately 4.27 million apps to download, consumers don’t realize just how vulnerable their personal data is becoming. And in-app advertising continues to grow with expectations it will reach $234 billion by 2025. That’s why we need to consider preventive measures to stop prying apps.

You may not be aware but the apps you download constantly run in background on your smartphone. They track location, memorize passwords and settings, and download information you enter to remote servers. If you think you are one-upping app developers by restricting the use of your information through privacy settings, you are wrong. You still may not be safe.

In 2013, the developers of “Brightest Flashlight Free” failed to inform users it was collecting and sharing their location data and identifiers. The state of New Mexico went after the apps developer, Tiny Lab Products. The state also outed advertising networks run by Google and Twitter, suing them for collecting background data from game consoles without user consent, including those used by children, violating their right to privacy.

The issue of control of our privacy lies with us. Today, phishing has expanded beyond e-mail and is now into mobile devices including tablets, game consoles, smartphones, and desktop and laptop computers. All are vulnerable to data breaches, click fraud, and app security fraud. 

How does the digital economy operate? Much like a bill collecting agency selling your data and information to the highest bidder with the excuse of using the information it gathers solely for the purpose to “improve its software.” But that is not the reality. For example, Google is under investigation by the Office for Civil Rights, Department of Health and Human Services, in the United States for its dealings in buying over 50 million private patient health records from several health insurance providers. This raises the question of the effectiveness of HIPAA, the Health Insurance Portability and Accountability Act of 1996 which is enacted in the United States to provide data privacy and security provisions for medical information. Apparently, Google saw an opportunity to take private mental and physical health records and expose them to a plethora of companies working on new software apps.

So what is to become of our online privacy in the face of these data breaches and the wholesale selling of our personal information online?

The Warez Community is the name associated with a group noted for online piracy of both software and personal digital data. From using random credit card generators to opening fake AOL accounts using real names in earlier years, we are now seeing an evolution of apps compromising our personal data and selling it to random companies. Today, we are more prone to identity theft and a lack of online privacy. Most uncomfortably, we have no recourse to access any of the information these companies have acquired about us. Today’s Big Tech is forcing us to accept the lack of control for our personal data.

To counter our loss of privacy, the tips provided in the infographic below should help you to keep a low profile when online, and to avoid known apps that steal your data.

In the last couple of weeks, North Americans have learned about yet another massive hack. In this case, the target was Capital One whose servers were hacked back in March of this year exposing the data of 106 million customers. The hack was attributed to Paige Thompson, who believed it would prove her skills and lead to a job offer. Instead, it’s likely she will serve time in federal prison.

What is frightening about her actions, is regardless of her intentions, Thompson exposed a major security flaw in one of America’s biggest banks. According to Matt Baker, founder of the cybersecurity firm EveryCloud, this was something that industry experts feared could happen for a very long time.

Considering that banks like Capital One have budgets to pay millions of dollars annually for state-of-the-art cybersecurity, what does it mean for the rest of us when it comes to our own vulnerability to hacks?

Privacy laws in North America place the onus on a business to secure client data. If it doesn’t it could face serious penalties and civil action. But small and medium businesses don’t have the millions to spend on security. So what can they do?

Take Proactive Action

For a start, it’s not enough to install an antivirus program and hope for the best. You can take other proactive steps to ensure your business is as hard a target as possible. This doesn’t guarantee that you’ll never get hacked, but the more difficult you make it for the hacker, the better your chances of warding off an attack. Businesses are not completely helpless when it comes to protecting themselves from hackers.

Follow these few steps and you can ward off hacks by people like Paige Thompson.

1. Change Your Passwords

Do you use the same password for every site you go to?

Have you changed your password in the last month?

Have you got a strong password?

Here are some password tips you should adhere to:

• A password should be at least 16 characters long.
• A randomly generated password that contains no recognizable words is better.
• A password should include special characters, a mix of upper and lower-case letters, and numbers.
• Your business password should be completely different from any other passwords you use.

2. Look into Security Awareness Training for Employees

Having a top antivirus program in place won’t do much good if your staff don’t know how to recognize and guard against different forms of attack. It’s good business practice to get professional assistance to train and test employees. Phishing emails sent from time to time will tell you if the training has worked.

3. Backup Data and Set Up a Recovery Plan

It’s best to assume that at some point your data will be hacked. That’s why it’s extremely important to do regular backups and to work out a recovery plan should your systems be compromised. That way, if something does happen, the damage can be limited.

By making cybersecurity a priority you’ll have a better chance of not experiencing a Paige Thompson in your future.

ᐧ