For more than two decades, email has reigned as the primary vehicle through which cybercriminals deliver malicious software to unsuspecting victims. Phishing emails laden with infected attachments and deceptive links have cost businesses and consumers billions of dollars annually. But a seismic shift is underway in the threat distribution hierarchy, and it is arriving through the very advertising infrastructure that funds the open internet.
According to a report from Business Insider, cybersecurity firm The Media Trust has projected that programmatic advertising will overtake email as the top malware delivery vector by 2026. The finding is based on the company’s analysis of billions of ad impressions and the growing sophistication of so-called “malvertising” campaigns that exploit the real-time bidding systems powering digital advertising worldwide.
The Mechanics of Malvertising: How Ads Become Weapons
Programmatic advertising is the automated buying and selling of digital ad space, a system that processes trillions of transactions each year across websites, mobile apps, and connected television platforms. When a user loads a webpage, an auction takes place in milliseconds among dozens of advertisers competing to display their ad. The winning creative is served instantly. This speed and automation, while efficient for marketers, has created a fertile environment for threat actors who can inject malicious code into ad creatives or exploit vulnerabilities in the ad-serving supply chain.
Unlike traditional phishing emails, which require the victim to open an attachment or click a link, malvertising can compromise a device simply by rendering an ad in the browser — a technique known as a “drive-by download.” In more sophisticated campaigns, malicious ads redirect users through a chain of intermediary domains before landing them on a phishing page or triggering an exploit kit that probes the browser for unpatched vulnerabilities. The user may never realize anything has happened, as the malicious activity occurs behind what appears to be a perfectly legitimate advertisement on a trusted website.
Why Programmatic Channels Are Increasingly Attractive to Cybercriminals
Several converging factors explain why attackers are migrating from email to programmatic advertising. First, email security has improved dramatically. Enterprise email gateways now incorporate machine learning, sandboxing, and URL rewriting to detect and neutralize threats before they reach inboxes. Consumer email providers like Google and Microsoft have invested heavily in spam and phishing filters. As a result, the success rate of email-based attacks has declined, pushing threat actors toward less defended channels.
Second, the sheer scale of programmatic advertising offers an irresistible attack surface. The global programmatic ad market was valued at more than $550 billion in 2023 and continues to grow at double-digit rates, according to industry estimates. Each ad impression represents a potential point of compromise. A single malicious creative uploaded to a demand-side platform can be served millions of times across thousands of websites before it is detected and pulled. The economics are staggering: for the cost of a modest ad buy, a criminal can reach an audience that would require millions of phishing emails to match.
The Supply Chain Problem: Opacity and Fragmentation
The programmatic advertising supply chain is notoriously complex. Between the advertiser and the end user, an ad impression may pass through a demand-side platform, one or more ad exchanges, a supply-side platform, and various intermediaries that handle verification, targeting, and delivery. Each handoff introduces potential points of vulnerability. Threat actors have learned to exploit this fragmentation by inserting themselves into the chain through shell companies, spoofed domains, or compromised accounts on legitimate ad platforms.
The Media Trust’s research, as cited by Business Insider, found that the number of malicious ad incidents detected across its client base increased significantly year over year, with particular spikes around high-traffic events such as elections, holidays, and major sporting events. These are periods when ad volumes surge and the pressure on ad-quality teams intensifies, creating windows of opportunity for bad actors to slip through review processes.
Publishers and Platforms Caught in the Crossfire
For publishers, malvertising poses an existential reputational risk. A reader who encounters a malicious ad on a news site or lifestyle blog may blame the publisher rather than the obscure ad-tech intermediary responsible for serving the creative. This erosion of trust can drive audiences toward ad-blocking software — which already affects roughly 30% of global internet users — or away from the site entirely. Premium publishers have responded by investing in ad-quality scanning tools and demanding greater transparency from their supply-side partners, but the arms race between defenders and attackers shows no signs of abating.
Major ad platforms including Google and Meta have published transparency reports detailing their efforts to remove malicious ads. Google’s 2023 Ads Safety Report noted that the company blocked or removed more than 5.5 billion ads that violated its policies, including ads distributing malware. Yet the volume of attempts underscores the magnitude of the problem. For every malicious ad that is caught, an unknown number slip through, particularly on smaller exchanges and open marketplaces where verification standards are less stringent.
The Connected Television and Mobile Frontier
The threat is no longer confined to desktop browsers. As programmatic advertising expands into connected television (CTV) and mobile in-app environments, malvertising is following. CTV devices, which typically lack the endpoint security software found on laptops and desktops, present a particularly attractive target. Researchers have documented cases where malicious CTV ads have redirected users to phishing pages displayed on companion mobile devices, or have exploited smart TV firmware vulnerabilities to install persistent tracking software.
Mobile malvertising, meanwhile, has grown in tandem with the explosion of in-app advertising. Malicious ads served within free mobile applications can trigger forced redirects to app store pages hosting trojanized applications, or can exploit WebView components to execute code on the device. The Interactive Advertising Bureau (IAB) has published guidelines for combating these threats, but enforcement is inconsistent across the fragmented mobile advertising market.
Industry Response: Standards, Regulation, and Technology
The advertising industry has not been idle. Initiatives such as ads.txt and sellers.json, promoted by the IAB Tech Lab, aim to increase transparency in the programmatic supply chain by allowing publishers to declare authorized sellers of their inventory. These standards make it harder for bad actors to spoof legitimate publisher domains, but adoption remains incomplete, particularly among smaller publishers and in emerging markets.
On the regulatory front, agencies in the United States and Europe have begun to take notice. The Federal Trade Commission has signaled increased scrutiny of ad-tech practices, while the European Union’s Digital Services Act imposes new obligations on platforms to address illegal content, including malicious advertising. However, enforcement actions specifically targeting malvertising remain rare, and the cross-border nature of programmatic advertising complicates jurisdictional efforts.
What Security Teams Should Be Watching
For enterprise security leaders, the shift toward ad-based malware delivery demands a reevaluation of defensive priorities. Organizations that have invested heavily in email security may find themselves underprotected against browser-based threats. Security teams should consider deploying browser isolation technologies, which render web content — including ads — in a sandboxed environment before delivering a safe visual stream to the user’s device. DNS-layer filtering and endpoint detection and response (EDR) tools configured to monitor browser processes can also provide additional layers of defense.
Employee awareness training, long focused on phishing emails, should be expanded to cover the risks of malvertising, including the dangers of interacting with suspicious ads and the importance of keeping browsers and operating systems patched. Organizations that operate their own websites should audit their ad-tech partners and demand contractual commitments to ad-quality scanning and rapid incident response.
The Road Ahead: A Threat That Grows With the Market
The trajectory identified by The Media Trust and reported by Business Insider reflects a broader truth about cybercrime: attackers follow the money and the traffic. As programmatic advertising continues its rapid expansion into new formats and platforms, the attack surface grows in parallel. The industry’s ability to police itself — through better standards, faster detection, and greater transparency — will determine whether the open, ad-supported internet can sustain the trust of its users.
What is clear is that the era of treating malvertising as a secondary concern is ending. For publishers, advertisers, ad-tech companies, and the security professionals tasked with protecting them all, the programmatic ad channel is fast becoming the front line of cyber defense. The question is no longer whether malvertising will surpass email as the dominant threat vector, but whether the industry will be prepared when it does.
WebProNews is an iEntry Publication