The Media Trust report: online ads surpassed email as the primary malware channel in 2025, accounting for 60%+ of all observed malware and phishing campaigns
Follow Lara O'Reilly … - Online ads leapfrogged email as the primary channel for malware in 2025, per a new report.
Context & Ripple Effects
Malvertising had already shown signs of being operationally disposable: Malwarebytes found that most ad accounts used for malvertising were used only once. Earlier reporting also tied high-volume malicious ads to distribution through major app inventory, underscoring that the risk reaches beyond conventional web placements.
The Media Trust’s finding marks a sharper channel shift: ad delivery is now being observed more often than email in malware and phishing campaigns. That matters because it moves a core security exposure into the advertising supply chain, where inventory, accounts, and intermediaries change rapidly.
First-order effects
- Advertising platforms, publishers, and their ad-tech partners face greater pressure to detect and remove malicious creative and fraudulent advertiser accounts before campaigns reach users.
- Security teams need to treat ad clicks and ad-rendered content as a leading phishing and malware exposure alongside email, rather than relying chiefly on email-focused controls.
Second-order effects
- The apparent prevalence of short-lived malicious accounts will push platforms toward tighter advertiser verification and faster account-level enforcement, potentially adding friction for legitimate buyers.
- Publishers and advertisers may demand stronger transparency from intermediaries whose inventory can carry harmful ads; previous malicious-ad campaigns with extensive reach illustrate why distribution-path accountability matters.
Third-order effects
- If the pattern persists, ad security is likely to become a more central product and procurement requirement across programmatic advertising, not merely a brand-safety concern.
- The shift also reinforces a broader move away from single-channel defenses: the related rise in malware-free intrusions and voice phishing suggests attackers adapt toward whichever access channel has the weakest controls.
The trend: Cybercrime is shifting toward trusted, high-volume distribution systems—including advertising—as defenders harden more familiar channels such as email.