Malvertising Campaigns

The NJCCIC has received reports of websites triggering malvertising campaigns involving exploit kits. Malvertising is referred to as malicious advertising and involves threat actors injecting malicious code into digital advertisements that may infect computers and mobile devices of unsuspecting victims visiting legitimate, reputable websites. Systems can become infected pre-click and post-click. A common misconception is that infections happen only when a user clicks on a malvertisement; however, scripts that auto execute and download malware may be embedded in the web page.  These scripts can also auto-redirect users to malicious websites.  The NJCCIC recommends that users maintain their browser, browser plug-ins, operating system, and anti-malware software at vendor-supported versions with all available security updates installed.  Users should review their browser extensions and plug-ins, and consider configuring the settings for those you wish to keep to “click-to-play” in order to avoid them from auto-executing.  Users should also consider using script management add-ons. As most ads and scripts are automatically implemented, you can use a script blocking browser extension to control your web content.