Understanding how malvertising manifests in actual attacks helps illustrate why this threat is so concerning for cybersecurity professionals.
Angler Exploit Kit Campaign
This sophisticated attack demonstrated the power of drive-by malvertising. The Angler Exploit Kit automatically redirected website visitors to malicious pages without requiring any clicks or downloads. Once redirected, the kit exploited common vulnerabilities in Adobe Flash, Microsoft Silverlight, and Oracle Java to install malware silently.
The attack was particularly effective because it targeted widely used browser plugins that many users hadn't updated. According to the FBI's Internet Crime Complaint Center, exploit kits like Angler were responsible for a significant portion of malware infections during their peak operation.
RoughTed Campaign
The RoughTed malvertising campaign showcased how attackers can evade traditional security measures. This operation circumvented both ad blockers and antivirus solutions through dynamic URL generation and sophisticated traffic routing.
What made RoughTed particularly concerning was its use of legitimate infrastructure. The attackers leveraged Amazon's cloud services and content delivery network to make their malicious ads appear more trustworthy and harder to block. This is now known as domain fronting, where an attacker uses legitimate infrastructure such as AWS and Cloudflare to masquerade their malicious servers and domains.
KS Clean Mobile Malvertising
This campaign specifically targeted mobile users through in-app advertisements. The malicious ads would trigger fake security warnings, claiming the device was infected and needed an urgent "security update." Users who agreed to the update actually installed malware that granted attackers administrative access to their devices.
These examples share common characteristics: they targeted trusted platforms, used social engineering to increase effectiveness, and leveraged legitimate infrastructure to avoid detection.
