Use an ad blocker for security, says FBI

US intelligence agency warns of the danger of malicious online advertising

The FBI has released a public service announcement warning that cyber criminals are using search engine ad services to impersonate brands and direct users to malicious sites that host ransomware and steal login credentials and other financial information.

While 'malvertising' is not new, there is always a surge before Christmas. The FBI notes that on many search engines, ads that appear at the top of search results can be hard to distinguish from the search results themselves. Fraudulent ads can direct the user to fake sites which look identical to those of well-known brands, but which contain links that download malware or steal credentials. The issue is particularly prevalent with cryptocurrency exchanges, where cyber criminals use stolen logins to extract funds.

Among the protective measures the FBI recommends individuals take using an ad blocker. "Use an ad blocking extension when performing internet searches. Most internet browsers allow a user to add extensions, including extensions that block advertisements. These ad blockers can be turned on and off within a browser to permit advertisements on certain websites while blocking advertisements on others."

This is the first time the FBI or a similar agency has recommended a technology that was once seen as a major threat to online businesses and the advertising industry. However, it was reported last year that the FBI, CIA and NSA agencies have all been installing ad blockers specifically to protect themselves from the threat from malicious online advertising.

Some ad blockers can remove ads from search engine results and videos, and browsers such as Firefox, Brave and Vivaldi now include ad blockers by default with no plugin required. But according to Statista, only about 40% of web users were deploying such technology in 2021.

Other measures recommended by the FBI include careful scrutiny of URL of any site you are directed to. Often domains are very similar to the well-known brand, but perhaps with a slightly different spelling or with substituted characters. It is also safer to search for the brand directly rather than following a link.

Businesses should institute domain protection services and educate employees about the dangers of spoof websites and downloading files from illegitimate sources.