Managed IT Services
Your office manager searches for the login page of a vendor’s portal, clicks the first result, and types in her credentials. The page was a sponsored ad, the site was a copy, and the credentials now belong to someone else. That is malvertising, and it is one of the few attacks that bypasses email security entirely because it never arrives by email. This guide explains what malvertising is in 2026, how it reaches a New Jersey small business through ordinary web searches, and the malvertising protection controls that stop it: DNS filtering, browser management, endpoint detection, and a few habits worth teaching every employee.
It is rewritten from our 2024 article, which focused on individual users; this version is for the business that has to protect all of them.
For the short, employee-facing list of search-ad scams and how to spot them, see our companion post on Google search ad scams. This article covers the organizational defenses.
What Is Malvertising?
People often ask what is malvertising and whether it is really different from phishing. Malvertising is the use of online advertising to deliver malware or lead people to fraudulent sites. Criminals buy ads through the same networks legitimate businesses use, including Google and Microsoft search ads, display networks on mainstream websites, and social media platforms. The ad looks ordinary. The destination does not: a cloned login page that harvests credentials, a fake software download that installs an infostealer or remote-access trojan, a “support” page with a phone number that leads to a scam call, or a page that silently exploits a browser vulnerability.
Three things make malvertising more dangerous now than when ad-based attacks first appeared:
- Search ads sit above the real result. When an employee searches for “Microsoft 365 login,” “QuickBooks support,” or the name of a software tool, a sponsored ad can appear first, styled almost identically to the organic listing. Many people click it without noticing the “Sponsored” label.
- AI has removed the tells. Cloned pages, ad copy, and fake support scripts no longer have the spelling mistakes and clumsy layouts that used to give them away.
- Ad networks police after the fact. Google and others remove malicious ads, but campaigns routinely run for hours or days first, and attackers rotate domains faster than reviewers can act. Security researchers have tracked repeated waves of malicious search ads impersonating popular business software, remote-access tools, and even security products.
Because malvertising arrives through a browser rather than an inbox, your email filtering never sees it. That is why malvertising protection has to live on the device and the network.
How Malvertising Hits Small Businesses
Understanding what is malvertising in practice means looking at the attacks we see most often against practices, firms, and offices in northern New Jersey follow a few patterns:
- Credential theft through fake login ads. Searches for bank, payroll, Microsoft 365, and software portals return a sponsored clone. The stolen login is used for business email compromise or payroll diversion within hours. Our guide to credential theft protection covers what happens next.
- Trojanized software downloads. An employee searches for a PDF reader, a video conferencing client, a VPN, or a remote-support tool and downloads it from an ad. The installer works, and it also installs malware that harvests saved passwords and session cookies or opens the door for ransomware.
- Fake technical support. Ads for “Microsoft support” or “printer help” lead to a phone number. The caller is talked into granting remote access or paying for a fake fix. Older staff and front-desk roles are targeted deliberately.
- Drive-by and browser exploits. Less common on patched systems, but an outdated browser or plugin can be compromised by simply loading a malicious ad.
- Brand impersonation of your own vendors. Attackers bid on the names of EHR vendors, legal research platforms, and tax software, knowing exactly who searches for them.
Malvertising Protection for Business: 7 Layers
No single tool stops every malicious ad, so malvertising protection for business is a set of layers. These seven layers, applied together, block the vast majority and contain the rest. They are listed in order of impact for a small business.
1. DNS filtering on every device
DNS filtering for small business is the single most effective malvertising protection available. When a user clicks a malicious ad, the browser first asks DNS where the destination domain lives. A filtering service checks that domain against continuously updated threat intelligence and, if it is known malicious, newly registered, or in a blocked category, returns a warning page instead. The click still happens; the damage does not.
Because the filter runs at the DNS layer, it works for every application, not just the browser, and it protects laptops at home and on public Wi-Fi when the agent is installed on the device rather than only on the office firewall. For a business this costs a few dollars per user per month and takes an afternoon to deploy.
2. Managed browsers with ad and script controls
Browser management is the second layer of malvertising protection. On company-managed devices, enforce browser policies through Intune or your management platform: keep browsers auto-updated, enable Microsoft Defender SmartScreen or Google Safe Browsing in enhanced mode, restrict extensions to an approved list, and consider a reputable ad-blocking or script-blocking extension deployed centrally. Blocking ads is not just a convenience; it removes the delivery channel. Note that some sites your business relies on may need to be allow-listed, so roll out with a feedback path.
3. Endpoint detection and response
When a user downloads a trojanized installer, EDR is the malvertising protection layer that notices the malware behavior that follows: credential dumping, persistence, unusual outbound connections. Paired with 24/7 monitoring, it turns a compromised laptop into a contained incident rather than a company-wide breach. Our mobile and endpoint security page covers the device layer.
4. Remove local administrator rights
Most malicious downloads from malicious ads need administrator rights to install drivers, services, or persistence. Standard-user accounts stop a large share of them cold and limit what the rest can do. Our post on why employees shouldn’t have admin rights explains how to make this change without disrupting work.
5. Multi-factor authentication and phishing-resistant sign-in
Malvertising protection cannot prevent every credential from being typed into a fake page. MFA ensures the stolen password is not enough on its own, and passkeys or hardware keys go further: they are cryptographically bound to the real site and simply will not work on a clone. See our guides to MFA for small business and passkeys for business.
6. Password manager autofill
A business password manager fills credentials only on the exact domain they were saved for. When an employee lands on a cloned login page, the manager offers nothing, which is a quiet, reliable signal that something is wrong. It is one of the cheapest malvertising protection measures available and improves password hygiene at the same time.
7. Awareness training with the right habits
Technology catches most malicious ads; trained people are the malvertising protection layer that catches the rest and report them. The habits worth teaching are short:
- Skip sponsored results when looking for a login page or a download. Scroll to the organic result or type the address directly.
- Use bookmarks for the portals you use every day: banking, payroll, Microsoft 365, the EHR, the practice or case management system.
- Never download software from an ad. Approved software comes from IT.
- Never call a phone number in an ad for support. Use the vendor’s number from the contract or the company directory.
- If a login page appears after clicking an ad, close it and go to the site directly in a new tab.
- Report anything suspicious the same hour, with no blame attached.
Our post on how to spot a scam email pairs well with this list for a quarterly refresher.
DNS Filtering for Small Business: What to Look For
Because DNS filtering for small business does the heavy lifting in malvertising protection, it is worth choosing well. For a New Jersey practice or firm, the features that matter are:
| Feature | Why It Matters |
|---|---|
| Device agent, not just firewall | Protects laptops and phones off the office network |
| Real-time threat intelligence | Malvertising domains are often hours old; static lists miss them |
| Newly registered domain blocking | Catches disposable domains used in ad campaigns |
| Category policies | Block categories your business never needs, reducing exposure |
| Allow-listing and user feedback | Keeps legitimate sites working without disabling protection |
| Reporting | Shows which users clicked what, which guides training |
| Integration with your monitoring | Blocked-click alerts reach the people who respond |
DNS filtering is also the control cyber insurers and frameworks increasingly expect under “web filtering.” The CISA Protective DNS program explains the concept in neutral terms.
A 30-Day Malvertising Protection Rollout
- Week 1: DNS filtering for small business devices. Deploy the agent to every company device and the policy to the office firewall. Start with threat blocking and newly registered domains; add category blocking after a week of reports.
- Week 2: Browsers and privileges. Push browser policies (auto-update, SmartScreen or Safe Browsing enhanced, extension allow-list, central ad blocker) and remove local administrator rights from standard users.
- Week 3: Identity. Confirm MFA is enforced everywhere, move administrators and finance staff to passkeys or hardware keys, and roll out the password manager with browser autofill.
- Week 4: People and process. Deliver a 20-minute session on malicious ads and search results, publish the bookmark set for daily portals, confirm the reporting path, and add blocked-click reports to the monthly security review.
EDR, if not already in place, goes in at the start, because it is also the control that catches whatever the other layers miss. By the end of the month, malvertising protection is no longer a project; it is part of the environment, and our monthly IT maintenance checklist keeps it current.
Malicious Ads by Industry: Who Attackers Impersonate
Malicious ads are targeted by search term, which means they are targeted by industry. Medical practices see ads impersonating EHR vendor logins, clearinghouse portals, and medical supply sites; a stolen EHR credential is a HIPAA breach, so our healthcare IT support team treats search-ad protection as a baseline control.
Law firms see impersonations of legal research platforms, e-filing systems, and document-signing services. Accounting and tax firms see fake tax software support, IRS e-services clones, and payroll portal copies, especially from January through April, when the FTC Safeguards Rule’s MFA and training requirements matter most. Professional services firms see fake Microsoft 365, Adobe, and Zoom downloads. Knowing which malicious ads target your staff is the first step to teaching them which search results to distrust.
What to Do If an Employee Clicked a Malicious Ad
- If credentials were entered: change the password immediately from a clean device, revoke active sessions, review MFA methods and mailbox rules, and watch for unexpected MFA prompts.
- If something was downloaded or installed: disconnect the device from the network, do not power it off, and have IT or your EDR provider investigate. Assume saved passwords and session cookies were harvested.
- If a phone number was called: if remote access was granted, treat the device as compromised; if payment was made, contact the bank or card issuer at once.
- Report and record the ad, the URL, and the time. Ad networks accept reports, and your records matter for insurance and compliance.
- Check for spread. Review sign-in logs and alerts for the affected user across all systems.
Our guide on what to do after a cyberattack covers the full response if the incident grows beyond a single device or account.
Malvertising Protection for Regulated New Jersey Businesses
A credential stolen through malicious ads is a breach vector like any other, and regulators treat it that way. HIPAA requires technical safeguards and workforce training that cover this; the FTC Safeguards Rule requires MFA, monitoring, and training; cyber insurers ask about web filtering, EDR, and MFA explicitly. The controls above produce the evidence each expects, and they are the same controls that protect against phishing and ransomware, so there is no separate budget line for malvertising protection. See our cybersecurity services page for how they are packaged.
Why Malvertising Protection Belongs in Every Security Plan
Most small business security plans are built around email: filtering, phishing training, attachment sandboxing. Those controls are necessary, and they leave the browser wide open. Every employee searches dozens of times a day, and every search is an opportunity for a sponsored result to lead somewhere harmful. Malvertising protection fills that gap with controls that are inexpensive, mostly invisible to users, and already expected by cyber insurers under the headings of web filtering, endpoint protection, and MFA. If your cybersecurity plan for small business does not mention DNS filtering or browser management, this is the chapter to add.
A note on scope: malvertising protection also covers the ads your business runs. Attackers occasionally hijack legitimate advertiser accounts to run malicious campaigns under a trusted name, so protect your own Google Ads and social advertising accounts with MFA, limit who can edit campaigns, and review billing and campaign changes monthly. A compromised ad account damages your reputation as surely as a breach of your own systems, and it can take days to recover control from the platform.
Malvertising Protection: Frequently Asked Questions
Does antivirus stop malvertising?
Not by itself. Traditional antivirus may catch a known malicious download but does nothing about a cloned login page. DNS filtering, browser protections, MFA, and EDR together provide real malvertising protection.
Should a business block ads entirely?
On company-managed devices, a centrally deployed ad blocker is reasonable malvertising protection and removes the delivery channel. Allow-list any sites your business depends on that require ads to function.
Is Google responsible for malicious ads?
Ad networks remove malicious ads when detected and accept reports, but they do not compensate victims and campaigns run before removal. Your protection has to be on your side.
Does DNS filtering slow down the internet?
No. Filtering adds a negligible delay to the DNS lookup and often speeds browsing by blocking ad and tracker domains.
How do we protect staff who work from home?
Malvertising protection for home workers means installing the DNS filtering and EDR agents on the company laptop so protection travels with the device, enforce MFA, and include home workers in the same training. Our cybersecurity tips for remote employees cover the habits.
Close the Door Malvertising Walks Through
Malvertising succeeds because it arrives where email security is not looking. DNS filtering, managed browsers, EDR, least privilege, MFA, a password manager, and trained staff close that door for a cost most New Jersey small businesses would consider trivial next to one stolen payroll login. eMDTec deploys and monitors this malvertising protection stack for medical practices, law firms, accounting firms, and professional services businesses as part of our managed IT services. Schedule a free consultation and we will check whether your devices are protected when someone clicks the wrong result.
Originally republished with permission from The Technology Press; substantially expanded and updated by eMDTec for New Jersey businesses.