Your staff are doing everything right. They’re not clicking on phishing emails. They’re not downloading dodgy attachments. They’re not visiting suspicious websites. They’re reading the BBC, checking the weather, looking at the trade press for your industry — and one of them picks up malware anyway.

This is malvertising, and it’s one of the more frustrating threats for small businesses precisely because the standard security advice doesn’t protect against it. “Don’t click suspicious links” is not useful when the threat arrives via a legitimate advert on a legitimate website.

How malvertising works

Online advertising runs through automated exchanges. When you load a news website, the ads you see aren’t placed there by the publisher — they’re served in real time by an advertising network that matches your profile to available ad inventory. The publisher has a relationship with the ad network; they don’t control, and often don’t know in detail, what ads are being served to their readers.

Attackers exploit this. They buy ad space through legitimate networks using fake or compromised advertiser accounts. The ads they submit look normal — a banner for a software product, a promotional deal for a service. But the ad creative contains malicious JavaScript, or the ad links to a page that runs an exploit kit designed to compromise browsers.

The most dangerous variant doesn’t require any click at all. Drive-by download attacks exploit vulnerabilities in your browser, browser plugins, or the underlying operating system to execute code the moment the ad loads. An employee visiting a completely normal website can have malware installed without clicking anything and without any visible warning.

Why it’s growing in 2026

Malvertising has been around for years, but two things have made it worse recently. First, the economics of online advertising have got murkier — more programmatic layers, more reselling of inventory, more opportunities for bad actors to get ads served through reputable networks. Second, attackers are using AI to generate convincing ad creative faster than ad networks can screen it, and to identify and time their campaigns around peak ad traffic periods.

The NCSC has noted a rise in malvertising campaigns specifically targeting UK businesses, with attackers increasingly using malvertising as the initial access vector for ransomware deployments. The pattern is: malvertising drops an information stealer that harvests credentials, those credentials are sold to a ransomware affiliate, and the business gets hit weeks after the initial compromise.

The SolarWinds, Log4Shell, and similar incidents created awareness that supply chain attacks are sophisticated. Malvertising is, in some ways, the lower-sophistication version of the same principle — you compromise the delivery mechanism (advertising networks) rather than the software supply chain, and you get access to a huge volume of potential victims.

What actually protects against this

The good news is that the technical mitigations are fairly straightforward, and none of them require significant budget.

DNS filtering is your first line. A DNS filtering service — Cloudflare Gateway, Cisco Umbrella, or the NCSC’s free Protective DNS service — checks every domain lookup your devices make against threat intelligence databases. When an employee’s browser tries to load a malvertising domain, the DNS query returns a block page instead of the malicious content. This won’t catch everything, but it stops a significant proportion of known malvertising infrastructure.

The NCSC’s Protective DNS service is free for UK organisations and genuinely effective. If you haven’t configured it for your business, it takes about 20 minutes to set up and should be a first step. It works at network level, which means it covers all devices on your network without any per-device configuration.

Browser extensions that block ads and scripts. uBlock Origin is the most widely used and most effective. It’s free, open source, and blocks the vast majority of malvertising by blocking the ad network requests before they load. This is slightly more aggressive than most businesses are comfortable mandating, but for high-risk users — people who regularly use consumer websites on work devices — it’s a genuine risk reduction.

If full ad blocking is too disruptive (some legitimate sites break without ads), consider configuring uBlock in medium mode, which allows ads from first-party domains but blocks third-party scripts — including the ad network scripts that carry malvertising.

Keep browsers and plugins up to date — and remove plugins you don’t need. Drive-by downloads exploit browser vulnerabilities. The fewer unpatched vulnerabilities in your browser stack, the smaller the window for exploitation. This is the same advice as general patching, but browsers specifically deserve attention because they’re updated frequently for security reasons and out-of-date browsers are disproportionately targeted.

PDF readers, Java, and Flash (still occasionally found on legacy systems) are also common exploit targets. If you’re running any of these as browser plugins, remove them unless there’s a specific, active business need.

Endpoint detection and response (EDR). If malvertising does get through, EDR tools can catch and quarantine malicious activity before it establishes persistence. Modern EDR for small businesses — tools like SentinelOne, Malwarebytes for Teams, or Microsoft Defender for Business — monitor for behavioural indicators rather than just known malware signatures. A drive-by download that drops novel malware will still trigger EDR rules if it tries to modify startup entries, inject into processes, or establish outbound connections to command-and-control infrastructure.

Microsoft Defender for Business is included in Microsoft 365 Business Premium, which many small businesses already pay for. If you’re on that plan and haven’t configured Defender, you’re leaving effective EDR on the table.

Telling your team

Your staff can’t defend against something they don’t know exists. Brief them on the basics: malware can arrive from legitimate websites through adverts; this isn’t about doing something wrong; if a browser window appears saying their system is infected and asking them to call a number or download something, that’s a scam linked to malvertising, and they should close the browser and report it.

Action Fraud receives reports of the “tech support scam” variant of malvertising constantly — it’s the one where an ad triggers a fake Windows security alert with a phone number. Staff who know this is a pattern won’t call the number; staff who’ve never heard of it might.

The technical controls matter most, but awareness makes the human response better when something does slip through.