When Ad Targeting Becomes a Cyberattack: Malvertising and Brand Risk

A targeted cyberattack is one aimed at a chosen person, organization or group rather than at random victims. Ad platforms' targeting tools let attackers make that choice cheaply and quickly, through ads that carry malware (malvertising), fake ads that impersonate a brand, and phishing campaigns designed to take over advertiser accounts. For a brand, the risk runs in two directions: your name can be used as bait in an attack, and your own ad account can become the attack tool.

Why is ad targeting useful to attackers?

Ad systems are designed to reach the right person at the right moment. You can target by location, device, interest and search query. The same flexibility that makes this valuable for a legitimate campaign makes it just as valuable for someone who wants to hunt a specific audience.

An attacker can, for example, show ads only to people searching for "download accounting software" or for the name of a bank. Because the ad appears at the top of the search results with a "sponsored" label, many users assume it is trustworthy. The more narrowly the target audience is defined, the less attention the attack draws and the later it gets caught by platform review.

What forms do ad-based attacks take?

Malvertising

The ad itself, or the page it leads to when clicked, tries to install malware or send the user to a fake download page. Most often, the "official download" page of a well-known piece of software is imitated. The user thinks they are installing the real program while downloading a malicious file.

Brand impersonation

The attacker runs ads for people searching your brand name and sends them to a page that looks like your site. The goal is to collect card details, passwords or personal data. When users are harmed, the party they usually blame first is the brand that was impersonated.

Advertiser account takeover

This is the least discussed scenario but the most costly one for brands. According to an analysis Malwarebytes published in January 2025, attackers ran fake Google Ads ads targeting businesses that use Google Ads; these ads led advertisers to phishing pages that stole their login details. Once in, the attacker added a new administrator with a different email address, locked out the real owner and used the account for their own malicious campaigns. In that situation, the budget being spent is yours and the ad being served is the attacker's.

Redirects hidden in the intermediary chain

In programmatic advertising, an impression passes through several intermediary platforms before it is served. The more checkpoints there are, the more gaps there are. A creative that looks clean at first can carry users to a different address through a redirect link that is changed later.

How big is the problem?

Platforms catch most of these ads before they go live, but not all of them. According to Google's 2025 Ads Safety Report, published in April 2026, the company blocked or removed more than 8.3 billion ads and suspended 24.9 million advertiser accounts in 2025. Of these, 602 million were scam-related ads and 4 million were scam-related accounts.

These figures say two things at once: enforcement on the platform side runs at a serious scale, and so do attack attempts. Even a small share that slips through before going live is enough to create a reputation problem on its own when it matches your brand name.

What are the concrete risks for your brand?

• Reputation: A customer defrauded through an impersonating ad writes the complaint under your name.
• Budget: In a hijacked account, the attacker can raise the budget and run their own campaigns.
• Data: Information collected on fake pages is used in new phishing attempts aimed at your customers.
• Ad account suspension: When your account serves a malicious campaign, the platform stops it. Your own campaigns can stop too, right in the middle of a sales period.

How do you protect your ad account?

1. Turn on 2-Step Verification. In Google Ads, go to the Admin menu, then Access and security, then the Security tab, and turn on 2-Step Verification in the sign-in verification section. Google's help page notes that an authenticator app is more secure than SMS; a security key is also among the options.
2. Clean up the access list every three months. Remove employees who have left, former agencies and manager accounts no longer in use. Give each user only the access they need to do their job.
3. Never sign in to your ad dashboard through an ad. Open Google Ads from a saved bookmark, not by clicking an ad in the search results. The whole attack described above depended on this one habit.
4. Monitor change history and budget alerts. A user addition you do not recognize, a sudden budget increase or an automated rule you did not set up is the first warning sign.
5. Limit the payment side. Setting limits and notifications on the card linked to the ad account caps the possible damage.

If you suspect your account has been compromised, Google recommends this order: report it to Google Ads as soon as possible; from the change history, note the timestamps of unauthorized user additions, the IDs of any unauthorized manager accounts that were linked and any unusual budget increases; then complete the account recovery steps. The same help page also has a separate step for requesting a refund.

What can you do against brand impersonation?

• Search your own brand regularly. Search your brand name from different devices and locations, with add-ons such as "download", "login", "customer service" and "promotion". Fake ads usually show up on these queries.
• Report fake ads to the platform. Save a screenshot of the ad, the displayed address and the address it leads to, and report it through the platform's ad complaint channel.
• Teach customers your official channels. On your site and in your emails, state your real domain, your support channels and that "we will never ask for your password or card details" clearly.
• Watch for lookalike domains. Domains with swapped letters or a different extension are a common method for impersonation pages.

How do you narrow the risk in display and programmatic advertising?

The more open your placements are, the harder control becomes. In display and video campaigns, review placement reports regularly, exclude sites and apps you do not consider suitable and, where possible, work only with a publisher list you have approved. Working with intermediaries that do not share placement lists or give transparent reports means not knowing what ran where when a problem occurs.

The same discipline applies to your own creatives: the ad's destination must be your own domain, and tracking templates and redirect links should be checked before going live. A meaningless spike in clicks or traffic from an unknown source in your performance data is sometimes the first visible trace of a security problem.

A short checklist

• Is 2-Step Verification on for all ad accounts?
• Is the list of who has which access to each account up to date?
• Does everyone sign in to the ad dashboard from a bookmark?
• Are change history and budget alerts checked weekly?
• Is your brand name searched monthly with add-ons such as "download" and "login"?
• Have your official channels been clearly communicated to customers?

If you want to review the security settings and placements of your ad accounts together, take a look at our Google Ads management service or get in touch.