Online advertising networks have become a common infection vector for mass-scale malware campaigns, particularly those involving ransomware. The practice, referred to as malvertising, involves disguising malicious content as online advertising links and distributing it through popular advertising networks. When a user clicks on one of these ads on a seemingly trustworthy site they are re-directed to malicious content. The attacks may include the practice of re-directing unsuspecting users to fake websites in order to earn advertising revenue for the perpetrators, stealing users’ personal information through phishing websites or infecting their computers with a virus. This week researchers at Malwarebytes reported that the website of the Daily Mail, a popular UK-based tabloid newspaper, was affected by the latter form of malvertising. 

The tabloid news site’s 156 million monthly visitors were exposed to the Angler Exploit Kit, a form of malware that searches user machines for potential vulnerabilities to exploit. In this case, the security holes being exploited were either based in Flash or Internet Explorer. Once a user clicked on an advertising link on the Daily Mail’s site and one of these vulnerabilities was detected, the exploit was subsequently used to facilitate a secret download of the CryptoWall ransomware. Ransomware is a type of computer virus which restricts a user’s access to their own files, demanding that a ransom is paid to remove the restriction. Paying the ransom is never recommended, as it may lead to additional demands or compromise the user’s information.

Malvertising attacks have affected several prominent websites this year, including Microsoft’s MSN web portal, Yahoo, AOL, PlentyOfFish and the Huffington Post. Some of the previous malvertising attacks this year have already utilized known vulnerabilities in the Adobe Flash platform. As a result, Google discontinued Flash-based advertising on its network earlier this year.