Malicious advertisements surge! 260% spike in 2015

“RiskIQ announced at Black Hat USA 2015 its latest findings on the prevalence of malvertising across the nearly two billion publisher pages and 10 million mobile apps it monitors per day.

In the first half of this year the number of malvertisements has jumped 260 percent compared to the same period in 2014. The sheer number of unique malvertisements has climbed 60 percent year over year. Meanwhile, fake Flash updates have replaced fake antivirus and fake Java updates as the most commonly method used to lure victims into installing various forms of malware including ransomware, spyware and adware.

The major increase we have seen in the number of malvertisements over the past 48 months confirms that digital ads have become the preferred method for distributing malware, said James Pleger, Director of Research at RiskIQ. There are a number of reasons for this development, including the fact that malvertisements are difficult detect and take down since they are delivered through ad networks and are not resident on websites. They also allow attackers to exploit the powerful profiling capabilities of these networks to precisely target specific populations of users.

The rise of programmatic advertising, which relies on software instead of humans to purchase digital ads, has generated unprecedented growth and introduced sophisticated targeting into digital ad networks.

This machine-to-machine ecosystem has also created opportunities for cyber criminals to exploit display advertising to distribute malware. For example, malicious code can be hidden within an ad, executables can be embedded on a webpage, or bundled within software downloads.

RiskIQs global proxy network of virtual software users scans billions of websites and millions of mobile apps per day for the presence of malvertisements, malware and malicious/copycat apps.

The companys most recent research into the prevalence of malvertisements yielded the following findings:

• Malvertisements have increased 260 percent on a pro-rated basis in the first half of 2015 (450,000) compared to all of 2014 (250,000)
• The number of unique malvertisements in June of 2015 (80,000) has jumped 60 percent in compared to the same period last year (50,000)
• The most common lure used in malvertisements in 2015 has been fake Flash updates, in 2014 the top lures were fake antivirus updates and fake Java updates
• In 2014, there was significantly more exploit kit activity (which silently installs malware without end user intervention) than fake software updates that require user consent
• In 2015, fake software updates have surpassed exploit kits as the most common technique for installing malware.