Malvertising and SEO Poisoning: Fake Downloads and Malware

Malvertising and SEO poisoning are two sides of the same trap: they turn online advertising and search results into channels for delivering malware. They usually rely on social engineering (they abuse the trust of a user who is looking for a popular program or clicking an apparently legitimate ad to induce a fake download), although drive-by malvertising can also exploit vulnerabilities in the browser or its plugins without any interaction. The result is usually a fake download that installs a trojan or an infostealer. Understanding how these techniques work is the first step to not taking the bait.

Searching for "download KeePass" or "AnyDesk official" in a search engine feels like a harmless action. Yet that is exactly where many attackers wait for their victims. Malvertising and SEO poisoning exploit a moment of trust (the user already wants to install the software) to slip in a manipulated installer. In this article we explain what both techniques are, how they differ, how they combine with social engineering, and which practical defenses reduce the risk for home users and organizations alike.

Key takeaways

• Malvertising delivers malware through the advertising network: malicious ads served by ad networks or injected into legitimate sites.
• SEO poisoning manipulates organic ranking or buys search ads to place malicious sites at the top when users look for popular software.
• Both techniques converge on the "fake download": a trojanized installer of KeePass, Notepad++, AnyDesk, Zoom, and similar tools.
• The usual payload is infostealers and loaders, often combined with the ClickFix technique (a fake CAPTCHA that induces the user to run commands).
• Key defenses are downloading only from official sites, DNS filtering, ad blockers, behavior-based EDR, and application allowlisting.

What is malvertising

Malvertising (a contraction of "malicious advertising") is the distribution of malware through online advertising. Instead of compromising the user directly, the attacker inserts harmful code or redirects into ads that are served through legitimate ad networks or injected into third-party sites. When the browser loads the ad, the victim can end up at an exploit kit, on a scareware page, or facing a fake download.

How a malicious ad is served

The modern advertising ecosystem is a chain of intermediaries: advertisers, buying platforms, ad exchanges, and publishers. That complexity is precisely what malvertising takes advantage of. An attacker can register as an apparently legitimate advertiser, pass the initial filters with clean creatives, and later switch the ad's destination toward malicious infrastructure. They can also compromise a provider in the chain to inject redirects without the final publisher knowing.

The user notices nothing unusual: the ad appears on a trusted outlet, with a professional look. The attack surface is enormous because the same ad can be shown across thousands of different pages.

Malvertising with and without a click

There are two main variants. In the first, the victim clicks the ad and is redirected to a malicious site that offers a download or displays a fake alert. In the second, known as drive-by, simply loading the ad triggers scripts that try to exploit the browser or its plugins without any interaction being needed. The drive-by variant is more dangerous because it does not depend on user error, although it is less common today thanks to more robust browsers and sandboxing.

In many campaigns malvertising serves as an entry point to a trojan or directly to an infostealer, which steals credentials, session cookies, and wallet data.

What is SEO poisoning

SEO poisoning is the manipulation of search engine ranking so that malicious sites appear in the top results when someone searches for popular software or trending terms. The attacker uses black-hat SEO techniques (generated content, link farms, short-lived optimized sites) or buys search ads to place their page above the official one.

The bait: the fake download

The goal is almost always the same: to lead the victim to a trojanized installer. Attackers clone the appearance of official pages for heavily searched tools such as KeePass, Notepad++, AnyDesk, or Zoom, register similar domains (typosquatting or convincing variants), and serve an executable that installs the real program (so as not to raise suspicion) alongside the malicious payload. The user believes they have downloaded the correct tool because, on the surface, it works.

This pattern is especially effective with remote administration software and technical utilities, because those who look for them often have elevated privileges on their machines.

Poisoning of trending terms

Beyond software, SEO poisoning feeds on trending topics: events, leaks, highly anticipated updates, or disasters. Attackers quickly create content optimized around those spiking searches and take advantage of the window in which there is still little legitimate content competing to rank. The victim searching for information ends up on a page that offers a supposed document, update, or player that is actually malware.

Malvertising versus SEO poisoning: the key difference

Although they are often confused and frequently used together, they are not the same. The distinction lies in the channel they abuse.

• Malvertising: abuses the advertising network. The vector is the ad, served through advertising platforms or injected into legitimate sites.
• SEO poisoning: abuses the organic ranking of search engines or search ads. The vector is the search result, whether it is ranked through manipulation or bought as a sponsored ad.

Both converge on the same destination: the fake download. That is why, from the victim's perspective, the experience feels similar (they arrive at a page that invites them to install something), but the entry route is different. An attacker can even combine both: use SEO poisoning to rank a domain and, at the same time, buy search ads pointing at the same lure. Understanding the nuance matters because the defenses also differ: blocking advertising mitigates malvertising, while verifying the download domain mitigates SEO poisoning.

The convergence with ClickFix and social engineering

Increasingly, these campaigns do not deliver an executable directly but instead lean on social engineering for the infection. The ClickFix technique is a prominent example: the malicious page shows a fake CAPTCHA or a "verification" message that asks the user to copy and paste a command, or press a key combination, to "fix" an alleged problem. In doing so, the victim runs the code that downloads the payload themselves.

This convergence is powerful because it shifts execution to the user and evades controls that watch for automatic downloads. The page hosting the fake CAPTCHA may have been reached through malvertising or SEO poisoning; the result is the same: an infostealer or a loader installed with the unwitting collaboration of the user.

These malware families are part of the broader range of threats we describe in our guide to types of malware. The infostealer steals, the loader deploys later stages, and in some cases the infection leads to living off the land or fileless techniques that abuse legitimate system tools to stay under the radar.

Warning signs that help detect the deception

Neither malvertising nor SEO poisoning is invisible. There are clues that, with attention, give away the trap before the download.

On the destination page

• The domain does not exactly match the product's official one (swapped letters, hyphens, unusual top-level domains).
• The page insists you use its own download button instead of linking to the official project.
• Urgency warnings, fake virus scans (scareware), or "human verification" messages appear that ask you to run commands.
• The result is flagged as a sponsored ad right above the official organic link.

In the downloaded file

• The installer's name or size does not match the official version.
• The digital signature is missing, expired, or belongs to an unknown entity.
• The installer requests permissions or asks to disable defenses without justification.

Verifying the domain and the digital signature before running is one of the most cost-effective checks. A legitimate installer from a serious vendor is usually signed by a recognizable entity consistent with the product.

How to prevent malvertising and SEO poisoning

Effective defense combines user habits with technical controls. No single measure is enough, but together they greatly reduce the likelihood of a successful fake download.

Habits and verification

• Download only from official sites. Reach the vendor's domain by typing it directly or from a saved bookmark, not through a search engine or an ad.
• Distrust sponsored results. When searching for software, the first result is often an ad; check the real domain before clicking.
• Verify domains and digital signatures. Compare the hash or signature when the vendor publishes them.
• Do not run commands dictated by a website. No legitimate CAPTCHA asks you to copy and paste commands into a terminal or the Run box.

Technical controls

• DNS filtering and ad blockers. They reduce exposure to malvertising by cutting off known advertising and distribution domains before they load.
• Behavior-based EDR. It detects the suspicious execution chain (for example, an installer that launches a command interpreter) even if the binary is new.
• Application allowlisting. Allowing only approved software prevents a trojanized installer from running, even if the user downloads it.
• User training. Awareness of fake downloads and fake CAPTCHAs is the barrier that closes the gap left by automatic controls.

At an organization's web perimeter, measures such as a WAF protect your own applications from ad or script injection, although they do not replace filtering on the user's endpoint. It is worth remembering that some malicious advertising relies on adware already present on the machine, so keeping browsers and extensions clean also reduces the risk.

These campaigns are often the first phase of larger intrusions. An infostealer delivered by SEO poisoning can steal credentials that are later used in frauds such as BEC or CEO fraud, which reinforces the idea of treating the fake download as a corporate security problem and not just an individual one.

Frequently asked questions

What is the difference between malvertising and SEO poisoning?

Malvertising abuses the advertising network (ads served by advertising platforms or injected into legitimate sites), while SEO poisoning abuses the organic ranking of search engines or search ads. Both techniques usually converge on the same goal: to lead the victim to a fake download that installs malware.

Can I get infected without clicking on anything?

With drive-by malvertising it is possible, because simply loading the ad can trigger scripts that try to exploit the browser. It is less common today thanks to modern browsers and sandboxing, but not impossible. In SEO poisoning, by contrast, the user almost always needs to click and download the fake installer.

Why does fake software sometimes work just like the original?

Because many trojanized installers include the legitimate program alongside the malicious payload. The user sees the tool install and run, so they do not suspect anything, while the malware runs in the background. A program appearing to work does not guarantee the download was clean.

Does a traditional antivirus protect me from these techniques?

It helps, but it is not enough on its own. Attackers generate new installers frequently to evade signatures. Behavior-based EDR, DNS filtering, and application allowlisting add extra layers that detect or block the infection chain even if the specific binary is unknown.

How are these techniques related to ClickFix?

ClickFix is a social engineering technique often delivered through pages reached by malvertising or SEO poisoning. Instead of downloading an executable, the page shows a fake CAPTCHA that induces the user to copy and run a command, so the victim installs the malware themselves and evades automatic download controls.

How do I verify that a download is legitimate?

Always reach the official site by typing the domain or from a bookmark, check that the URL exactly matches the vendor's, avoid sponsored results, and validate the digital signature or hash of the installer when the vendor publishes them. If any message asks you to run commands to "verify yourself," stop: that is a sign of fraud.

Related resources

• ClickFix: the fake CAPTCHA as social engineering
• What is an infostealer
• Types of malware
• What is a trojan
• What is adware
• What is a WAF (Web Application Firewall)
• Living off the land and fileless attacks
• What is BEC or CEO fraud

Secra: offensive security to stay ahead of the threat

At Secra we are an offensive cybersecurity company with our own vulnerability research program. Our team has discovered and reported real CVEs, such as CVE-2025-40652 in CoverManager and CVE-2023-3512 in Setelsa ConacWin CB, published in the NVD and in INCIBE-CERT. That hands-on experience lets us help your organization understand how attackers who abuse advertising and search results to distribute malware think, and to strengthen your defenses before a fake download becomes an incident. If you want to assess your exposure, get in touch with us.