Articles by: "Gavin Dunaway, Product Marketing – The Media Trust"

Publishers beware: 3 malware trends for Q4

October 10, 2022 Gavin Dunaway, Product Marketing – The Media Trust

As the days grow shorter and the pumpkin spice overfloweth from lattes, a bitter wind blows through the digital ecosystem, dropping malicious intent into every nick and cranny. Little devils ride the waves of code, seeking to trick and gladly snatch treats away from consumers in the form of stolen credit card info and personal data. All the while, they leave backdoors open on devices so they can return to wreak more havoc.

The fourth quarter can be the most wonderful time of year for publishers’ digital revenue efforts. Unfortunately, it can also be a lucrative moment for digital ghouls, with deal-hunting shoppers falling prey to malevolent code lurking beneath the surface of ecommerce sites.

Conventional wisdom holds that threat actors pull back from clogging the advertising pipes with malware in Q4 as premium publishers book more direct deals and there’s a dearth of cheap inventory. But threat actors are a devious bunch. They have diverse strategies for inflicting maximum harm on online consumers—and some particularly nasty tricks tend to appear during the holiday season.

Publishers play a key role here in keeping audiences safe from digital dangers. They must also help rid their advertisers and demand partners of malware demons.

Advertisers transform into malvertisers

It’s said when the moon is full and red as blood, advertisers large and small howl out in pain as they morph into the most fearsome of digital beasts—malvertisers!

OK, it’s not that dramatic. In fact, a lot of legit advertisers are completely unaware that they are spreading backdoors and phishing through their landing pages. Schemes like MimicManager-3pc lurk in the shadows and are quite hard to detect. It typically enters an advertiser’s site through a corrupted JavaScript library, and doesn’t actually show up in the call chain when it drops a malicious payload (e.g., a redirect with a backdoor).

Caption: The amount of malicious landing pages in the digital ecosystem grew dramatically over summer 2022 as MimicManager proliferated.

As of publication, MimicManager has already infected hundreds of advertiser websites, from local real estate and travel agents to major ecommerce sites. And it’s been compromising three to seven new websites per day ever since, with multiple threat actors using the tool to meet their own malevolent goals: backdoors, phishing, e-skimming, cryptojacking, etc.

Smaller and midsize advertisers are more likely to fall prey to these schemes because their publishing software and plugins are out-of-date. (And, in many cases, that’s because a third-party design firm manages them.) MimicManager is a fearsome threat because it’s quite good at evading detection, and certain variations only fire if the right targeting parameters are met (e.g., mobile browser).

The fast spread of MimicManager is particularly worrisome as the holiday buying season heats up and consumers click on ads left and right. By shutting down ads with compromised landing pages, publishers can protect their audiences. However, they need to take it a step further and share their findings upstream. Advertisers, and their platform partners, must be informed to stop the spread.

Retail hijinks

eMarketer predicts worldwide ecommerce sales will only climb by 9.7% this year compared to the wild growth witnessed during the peak of the pandemic. But that’s still $5.7 trillion, and around 20% of the entire retail market.

No surprise that a lot of scammers want in on that cash. Advertising CPMs might be higher in Q4, but many bogus retailers still use the ad pipes to woo consumers to their shady shops. The amount of scam ads blocked by Media Filter, The Media Trust’s real-time ad quality solution for publishers, doubled between April and September. And the top 10 companies blocked are all fake retail outlets

As the number of scam ad blocks have doubled over the past 6 months, the top 10 companies blocked have all been bogus retail websites.

These scam ecommerce operations sometimes send goods that bear no resemblance to what was purchased and no way for a consumer to seek restitution. Or they’ll flat-out take consumer cash and disappear into the night.

The top four bogus retailers blocked are owned by the same sketchy Chinese company and feature interchangeable merchandise and page layouts. With consumer economic concerns running high this holiday season, deal-hunters will be easy target—unless publishers ensure their scam ads don’t make it in front of their audiences.

E-skimming epidemic

But legit retailers have real problems as well. While e-skimming tends to spread during Q4, the proliferation of credit card and personal-data stealing code has been absolutely stunning in 2022.

The amount of e-skimming has doubled year over year and we’ll likely see massive growth in the next few months across ecommerce platforms. Quite worrisome is the re-emergence of a threat group that dominated e-skimming efforts for much of the twenty-teens.

E-Skimming incidents are double what they were a year prior and tend to grow sharply in the fourth quarter.

Don’t get spooked

Publishers are the last line of defense when it comes to protecting consumers from digital threats. For many ad and revenue operations folk, this too often just feels like getting the damn redirects to stop so the executives will quit howling.

But especially in Q4, the threats truly stretch across all the players—and keeping consumers safe means more than just blocking a “high-risk ad platform.” The good news is that audiences will have a higher propensity to click your ads this holiday season. Unfortunately, that also means a higher chance they’ll run into scams, e-skimmers, or other horrors. Making sure the ads on your properties are clear of danger means communicating with platforms and advertisers when you see trouble.

It always seems a bit like Devil’s Night in the digital ad ecosystem. It’s a good thing publishers are a fearless bunch.

Perspectives | Revenue | Supporter Spotlight

How publishers can ride the retail media wave

July 11, 2022 Gavin Dunaway, Product Marketing – The Media Trust

It ain’t hype anymore—retail media is real, and it is spectacular. eMarketer calls retail media the “third wave of digital advertising,” with U.S. ad spend expected to hit $41 billion in 2022. Boston Consulting Group predicts retail media will account for 25% of digital media spending by 2026.

The channel has arguably revived Criteo’s fortunes as the third-party cookie dwindles into irrelevance. Walmart, Target, Kroger, Best Buy, Home Depot, Gap, CVS—it seems like every other week another major retailer carts out a brand-spanking-new retail media network.

All that ad spend sure sounds great for retailers. But what about publishers? Are retailers siphoning spend away from the already beleaguered publisher set?

Quite the opposite, in fact. The retail media revolution is helping line the pockets of premium publishers.

Cautious journey to digital advertising

In a nutshell, retail media is when retailers offer advertising access to their customers on-property (or off-property). It’s not a new concept by any means, but it’s been mainly relegated to advertiser campaigns in actual brick and mortar stores. (Think about specialty brand displays at department stores or supermarkets.)

While retailers’ online traffic grew with the rise of ecommerce, many were reluctant to plunge into digital advertising because of their hyper focus on user experience. A 2006 Amazon study famously found that every 100ms in extra load time cost 1% in sales; a 2017 Akamai followup suggested that every 100ms of latency cut conversions by 7%.

Unfortunately, digital advertising has a bad reputation for latency, as well as other factors that ruin user experience: gauche creative, code that breaks a page, open doors to device-infecting malware, etc. All those issues can arise before programmatic enters the picture. With bad user experience being detrimental to online sales, digital advertising simply wasn’t worth the risk for most retailers.

Yet they no doubt had their eye on Amazon’s flourishing ad business. There should be an asterisk by eMarketer’s $41 billion in 2022 US ad spend figure: about 78% of that goes to Amazon. However, the $9 billion left over is nothing to sneeze at, and you may have noticed Amazon does a fair deal of third-party media buying.

U.S. retail mainstays like Walmart, Target, and Kroger have been ramping up their digital retail media operations for the last five years. And then came the Covid pandemic: Suddenly consumers weren’t in stores; they were flooding websites and apps and racking up online orders. The opportunity to monetize this traffic was just too good to pass up, especially as major retail brands had proven that integrating ads wouldn’t necessarily harm user experience.

Advertiser appeal

Retailers have the kind of high-quality audience data that make advertisers swoon. Through tools like loyalty programs, many retailers boast comprehensive customer profiles that can be used for precise targeting. Retailers are stocking up on data scientists to drive customer insights and behavioral trends, and for many advertisers measurement goes all the way to point of sale.

In addition, retail sites and apps are a data oasis in the increasingly untargetable mobile ecosystem. The presence of emails and other deterministic identifiers make retailers ideal partners for identity solutions like LiveRamp and LiveIntent in finding audiences on third-party properties.

On-property advertising is really only the jump-off point. The huge gains are in audience extension, or when retailers start finding their customers on third-party sites and apps.

Quality quest

That’s where premium publishers come in. When asked at the IAB Annual Leadership Meeting in January if she felt that retail media networks were a threat to revenue, BET EVP and CMO Kimberly Evans Paige replied, no—we’re partnering with them.

Advertising revenue is incremental for retailers. Therefore, advertising must be accretive to the core revenue business. On-property, this means high-quality, brand-safe ads that don’t cause latency. Landing pages can’t send customers to competitor sites and only authorized vendors can be allowed through the pipes, lest data leakage become a concern.

Going off-property is not just extending the audience, but also the retailer brand. During an AdMonsters Ops session in June, Christine Foster, Vice President, Media Operations at Kroger mentioned that a great deal of their offsite ads are actually co-branded. So, retailers with big advertiser budgets in tow may be reticent about appearing adjacent low-quality ads, scam ads, or ads with questionable content, which could range from gambling to marijuana to even crypto.

When retailers buy off property, they need high-quality inventory in well-lit spaces. To ensure brand safety—both their own and advertisers’—retailers are pursuing guaranteed direct deals with premium publishers as well as private marketplace arrangements. Certainly, major publisher brands with massive traffic are already benefiting. But there’s definitely room out there for niche publishers with ties to specialized retailers.

Lifting all boats

The excitement around retail media stems from the fact it’s beneficial for just about every party in the digital media ecosystem: Advertisers reach key audiences with confidence; ad tech companies like Criteo and CitrusAds develop new business; publishers gain revenue; and of course retailers are able to further monetize their customer data.

Publishers of all sizes need to investigate retail media opportunities. However, they also need to understand that their ability to rake in revenue here greatly depends on the quality of their environments.

Advertising | Industry-Research | Perspectives | Supporter Spotlight

Prospering in the increasingly dangerous open programmatic market

January 21, 2022 Gavin Dunaway, Product Marketing – The Media Trust

It was a fourth quarter to remember…and a fourth quarter to forget. The main reason to remember is so other Q4s will look positively luminous in comparison. I’m not just talking about the wrath of Omicron, which ruined holidays for countless families and continues to cause illness, death, and emotional distress across the globe. I’m talking about an alarming rise in malvertising that endangers publisher revenue and consumers’ online safety.

As publishers struggle more than ever to balance user experience and monetization, the perils of the open programmatic marketplace require higher levels of vigilance, lest audiences be lost in a storm of malware. Let’s explore the factors behind the rise in malvertising and what publishers can do to combat its impact.

Malware incidents on the rise

*While malvertising typically subsides in the fourth quarter with higher inventory prices, Q4 2021 malware levels were disturbingly high.*

In the digital ecosystem, The Media Trust detected a 64% increase in malware incidents during the final quarter of 2021 — which can account for thousands of impressions or hits — as compared to the same time period in 2020. And 2020 levels were already high as the programmatic marketplace struggled to snap back during the early days of the pandemic.

Malvertising levels this high at the end of the year are unusual. It typically subsides a bit in the fourth quarter. Because increased advertiser demand enables publishers to increase CPMs and raise programmatic floors most malvertisers are priced out of the market.

However, Q4 2021’s record malware numbers weren’t the result of a few blanket attacks. The industry was assaulted by a wide variety of malicious code and content:

Redirects peaked in October, growing 170% over the course of the year.
In November, Digital media was awash in FizzCore, a notorious form of malicious clickbait that employs cloaking technology to hide its devious content. The amount of FizzCore detected grew 9X over two months.
An outbreak of fake antivirus/software update ads also hit hard in November, marking a 50% rise since the beginning of the year.
E-skimming typically increases in Q4 as bad actors hunt for consumer credit cards, but the amount detected in Q4 2021 was 63% higher than the year prior.
Scam ads, which surged in 2021 and made up nearly a third of malware in the space, stayed high and ticked up an extra 9% in December — nearly exceeding the summer peak.

A most malicious year

*While 2020 saw a surge in malvertising caused by advertisers’ pandemic pullback, the amount of malware in the digital ecosystem in 2021 has been dramatically higher.*

Unfortunately, these numbers are representative of 2021 as whole, where malware simply exploded. The Media Trust’s Digital Security and Operations team managed an average 2,210 malware incidents daily. That’s a 64% increase over 2020 and well above the ~1,000 historical average. During the summer — the height of the 2021 malware blitz — average daily malware incidents stayed above 3,000.

Overall, The Media Trust identified 26,664 new malware incidents in 2021, a ~30% increase over the number cataloged in 2020. And our creative blocker, Media Filter, halted four times more malware than in the year prior.

The proliferation of malvertising is simply breathtaking.

What’s behind the rise in malvertising

Certainly the 2020 surge in malvertising followed advertisers’ pause in spend; bad ads flooded the programmatic advertising space as publishers lowered floors to grab whatever revenue they could. But even as the pandemic drags on and on, programmatic markets seem to have rebounded. So, what’s behind this incredible 2021 surge in malware?

First, from a programming perspective, the malvertising barrier to entry is very low. The dark web is full of malware kits for sale including turnkey phishing solutions and the ever-popular ransomware-as-a-service. There’s a whole black market ecosystem for selling pilfered data and access to infected devices — and often no legal repercussions for bad actors (though there were some impressive arrests in 2021).

Secondly, research from eMarketer found that private marketplaces account for more RTB spend than the open programmatic marketplace. With $15.4 billion in advertiser spend in 2021, private marketplaces made up 56% of all RTB-transacted dollars. The open marketplace sat at $12.3 billion and had a 44% share.

According to eMarketer, the shift to private marketplaces is only going to accelerate in 2022. Spend is predicted to increase another 21% and make up 59% of all RTB spending. However, the open marketplace will only grow 5% and dwindle to a 41% share of RTB spend.

We also see premium advertisers are investing heavily in connected TV (CTV) — although they’re struggling with campaign measurement — direct, and programmatic. These advertisers shifting their buying power away from the open marketplace is likely depressing CPMs. It is also making more room for bad actors to spread a variety of malicious wares.

Is it time to give up on open programmatic?

So, if the open marketplace is suffering from a rapidly growing malware infestation, am I suggesting publishers turn off their open programmatic pipes post-haste? Heavens, no! That’s not really an option for most digital publishers. Can you imagine the amount of revenue left on the table? All the unfilled inventory?

It’s obvious why private marketplaces are increasingly attracting advertiser dollars: high viewability, actually engaged human beings rather than bots, and impressions on well-respected publications. We’ll see top-tier publishers layering in high-impact audience segments that will likely outperform third-party cookies.

But the challenge with private marketplaces has always been getting them to scale. I still hear publishers lament long-lingering Deal IDs with laughable fill rates. Truly getting private marketplaces to hum requires time and resources, something many publishers in the “fat middle” struggle with.

Premium advertisers will keep buying in the open market. This may be to cherry-pick super-cheap inventory on premium publishers or for prospecting purposes. Smaller advertisers may find it easier to reach target audiences across a wider crop of publishers. Publishers also use the open marketplace to find new advertiser prospects and evaluate the market value of various types of inventory and audience segments.

Your best defense against malvertisers is high quality data

The open programmatic marketplace may be getting seedier but diligent publishers can still drive a ton of revenue. It’s just going to take more work to keep audiences safe from all the fraudsters spread across the programmatic pipes.

Having a page/app-level creative blocker to bat away malware before it hits your property is table stakes. But with this massive expansion of malware in open programmatic, the quality of data fueling your blocker is more important than ever. Publishers can’t go cut-rate. Their ad-quality provider should be pumping data into the blocker in real-time from an in-house team of malware analysts. Third-party malware data isn’t going to be fresh enough. It may also lead to revenue-bleeding false positives.

And finally, publishers need to be a lot more discriminating when it comes to their open marketplace partners — and by extension, those partners’ partners. Especially during the pandemic, publishers have been willing to install most demand sources that might give them an edge with bid density. But open programmatic is getting too dangerous to be carefree about the companies you monetize with. Ensure all your demand partners are scrutinizing both tags and landing pages (preferably from a variety of device and geographic profiles). And if a high percentage of the ads they bring you get shot down by your malware blocker, maybe they’re not the right fit for you.

Open programmatic is definitely becoming a more dangerous place for monetization. But that doesn’t mean it’s not worth the revenue. With the right tools and policies, publishers can make bank — and keep their audiences safe and happy.

Advertising | Perspectives | Policy | Supporter Spotlight

A regulatory reckoning over scam ads approaches

November 3, 2021 Gavin Dunaway, Product Marketing – The Media Trust

The classics are so well-known they’ve become punchlines: acai berry treatments, one simple trick to get rid of belly fat, get rich working from home. Newer scam ad verticals like bitcoin and crypto schemes, home solar energy savings, and nutritional supplements for diabetes sufferers are slamming consumers on every corner of the Internet.

And yet scam and deceptive advertising is simply accepted as an ugly part of digital media and advertising. And it’s only getting uglier. Since the beginning of 2021, The Media Trust has detected a 50% increase in scam campaigns hitting publisher properties. Still, too many AdTech companies and publishers look the other way as the scams roll through the programmatic pipes, hoping their audiences have the good sense not to be bamboozled.

*The Media Trust detected unique scam campaigns ramping upwards throughout 2021 with a major spike in July.*

Unfortunately, there have been virtually no consequences for sites running scam ads. There’s the occasional massive fine, like when the Federal Trade Commission came down hard on Clickbooth for its acai berry barrage. However, for the most part, scammers advertise with impunity and AdTech and publishers become their accomplices.

However, consequences may be coming—and the fallout may be dire—judging by the developing online regulatory situation in the UK and increasing attention elsewhere.

The scope of online safety measures

British Prime Minister Boris Johnson has promised to present the Online Safety Bill before Christmas. The bill would require publishers, social networks, and many communication/messaging apps to deter, remove, and mitigate the spread of Illegal and harmful content—particularly when aimed at children. The bill threatens fines as high as £18 million or 10% of global revenue, and possible crimi n al sanctions.

Beyond content that sexually exploits children (which must be reported to law enforcement), the harmful content in question includes malicious trolling and racist abuse—with the added goal of “protect[ing] democracy,” presumably through stemming online disinformation. The UK Office of Communications (Ofcom) will enforce the proposed law, which will also give the regulatory agency the ability to completely block access to a site or platform.

However, advocates like famed British personal finance advisor Martin Lewis think the bill doesn’t go far enough. That’s because it’s laser-focused on user-generated content and doesn’t regulate online advertising—most notably scams. Lewis, whose likeness is often exploited in scam ads pushing bitcoin schemes, has been on a crusade against online scam ads for years, including forcing Facebook to settle for £3 million over a 2018 lawsuit regarding more than 1,000 scam ads featuring his appearance.

Drowning in scam ads

The data backs up Lewis’ claim that the “The UK is facing an epidemic of scam adverts.” In 2020, 410,000 cases of fraud reported to the UK police represented a 31% jump from the year prior, according to consumer group Which?, with £2.3 billion fleeced. Including anxiety and psychological damage, Which? puts the actual total suffered by UK consumers at £9 billion.

And the greatest frustration among consumers and public advocacy groups is the lack of recourse and sense that scammers act with impunity—aided by AdTech and digital media. In another Which? report, 34% of consumers said a scam they reported to Google was not taken down, while 26% said the same of Facebook.

In 2020, The National Cyber Security Centre removed more than 730,000 websites hosting scam advertising landing pages featuring the likenesses of Lewis, Richard Branson, and other celebrities. Despite that effort, The Media Trust has seen a 22% increase in these types of scam (aka “Fizzcore”) content throughout 2021 that use similar landing pages.

*Fizzcore attacks, which typically feature celebrities and hawk bitcoin scams, have grown 22% over 2021 despite crackdowns.*

Fizzcore is more nefarious than other scams because it employs cloaking to hide malicious creative and/or landing pages from creative audits and other detection techniques. The vast majority of these have been pushing bitcoin investment scams, often with the same Lewis and Branson content.

*Personal finance advisor Martin Lewis and billionaire philanthropist Richard Branson are common faces in scam ads directed at UK citizens.*

Even if online scam advertising fails to make the final Online Safety Bill, a reckoning for scam ads could come in other forms. The UK’s Department for Digital, Media, Culture and Sport (DMCS) is developing the Online Advertising Programme (OAP), a framework that enables regulators to address potential consumer harms from digital advertising, including scam ads.

And just to pile on, UK. Home Secretary Priti Patel announced a relaunched Joint Fraud Taskforce on Oct. 21. Addressing the significant rise in scams during the peak of the coronavirus pandemic, the taskforce will focus on addressing scams and fraud through private-public partnerships and refurbishing of government reporting tools.

Fallout beyond the British Isles

The ramifications of all this regulatory (buildup) ought to make the industry anxious. The Online Safety Bill would put heavy new burdens on publishers and social media in moderating user content in the UK, but the inclusion of scam ads might directly affect revenue. In the absolute worst-case scenario, publishers would need to vet all specific advertisers running on their sites as well as be familiar with all creative to avoid liability. That could mean many risk-averse publishers shut off programmatic advertising.

Scam advertisers are notoriously hard to pinpoint. They use any and every buying platform available, and then tools like cloaking in code to hide their malicious motives. When it comes to rooting out scam campaigns, the proof isn’t completely in the ad code. While creative and domain patterns can be identified and blocklisted, finding scammers also requires investigation into the elusive end-advertisers, their motives, and their histories. It’s not impossible, but it requires dedicated teams always on the pursuit.

Beyond stopping scammers cold at the source, the next best way to stem proliferation of scam ads is to bring culpability to publishers and their AdTech partners. However, publishers are the low-hanging fruit. The website was where the consumer was attacked, so they’ll always be the prime regulatory target.

Despite the intense pressure in the U,K., regulators in other countries are also most definitely paying attention and looking for a potential roadmap. In the U.S., reform of Section 230 of the Communications Decency Act—which shields online media companies from legal liability regarding user-generated content—appeals to both major political parties. Really, what politician would say no to the easy win of protecting consumers from online scams? According to the Federal Trade Commission, consumers lost $3.3 billion to fraud in 2020, up from $1.8 billion in 2019—and that’s only the 2.2 million reports filed.

Self-regulation to the rescue?

The IAB UK is conversing with the DMCS on the OAP, but ultimately the trade group believes industry self-regulation is the answer. While self-regulation on the data privacy front became a mockery of itself, self-regulation of scam ads doesn’t need to meet the same fate. First off, trade groups like the IAB need to establish stronger ad quality guidelines that offer standards for handling malvertising, scam, and other harmful ads.

In addition—or short of that—publishers need to take control of their own destinies regarding scam ads. Every ad quality provider should be identifying scam ads and enabling publishers to block them. Slapping down redirects simply isn’t enough for a bad-ad-blocker—a publisher serving scam ads is violating the trust of its audience and leaving consumers vulnerable.

Not only is blocking the scam ads the right thing for publishers to do, it is a way to get ahead of—or perhaps helping avoid—a regulatory onslaught that will have catastrophic revenue consequences. Failing to mitigate will come back to haunt the industry.

Advertising | Perspectives | Revenue | Supporter Spotlight

When browser extensions attack: Meet LNKR, an ad ecosystem nightmare

August 11, 2021 Gavin Dunaway, Product Marketing – The Media Trust

My toddler and I share a love for the misadventures of Shaun the Sheep. In particular, we love the episode where sheepdog Bitzer is cleaning the farmhouse window. But the Farmer keeps pointing out specks that Bitzer, try as he might, cannot see.

After countless elaborate attempts to clean the windows, Bitzer notices a chunk of dirt on the Farmer’s coke-bottle glasses. The windows were spotless. The Farmer’s smudgy glasses caused him to see phantom blemishes and incite a great deal of (highly entertaining) chaos on the farm.

Recently, this episode came to mind when talking to a DSP about why a slew of their ads were being blocked on various publishers sites (by a different ad quality provider). The DSP shared the report with us. As we examined the wide variety of blocked ads, we confirmed they were clean. There was no cloaking or malicious code, no compromised landing pages. They were basically spotless. After some analysis, it clicked: We were witnessing fallout from LNKR.

LNKR is the smudgy glasses problem transported to digital media. However, it is far more devious and likely to wreak havoc throughout the digital advertising ecosystem.

The trouble with browser extensions

At heart, LNKR is the browser extension heir to the malicious toolbar, a classic form of adware. Browser toolbars tended to create extra ad slots on publisher pages to serve ads. (These sometimes came with even more noxious malware.) However, LNKR simply injects malicious code right into one or more existing ad placements—on top of publisher-served ads. Most often, the malignant code prompts an auto-redirect with a fake software upgrade or antivirus tool download. (Surprise—it’s really more malware!).

Consumers knowingly (perhaps looking for some unique feature like “change text into pirate speak,” ya landlubber), or unknowingly, install a browser extension with LNKR code. Once that’s done, the LNKR operators can deliver redirect code into any ad slot at any time when the infected browser visits any website. If the malicious code is injected and the redirect is served, the consumer comes under attack.

Reputation and revenue

To compound the problem, they they’ll think that the publisher they just visited served them malvertising. The publisher’s brand is damaged even though it had nothing to do with the attack. (That character defamation also gets passed upstream to the SSPs and DSPs serving ads to the user.)

A publisher’s bad-ad blocker may shut down legitimate ads because users with the LNKR-infected extension have unwanted code injected on top of them. That could rob publishers of revenue. That’s because every single ad campaign served to the infected user will be mistaken for malware and slapped away.

If not corrected at the user level, or discounted from malvertising reporting, most eligible creative sent to an infected user will eventually be blocked. Thus, the scenario in the be bad ads ad infinitum. SSPs will scream at DSPs for pushing malware through the pipes when the accused advertising creative and supply chain is legit. This can further come back to bite the publisher if SSPs pause or cut off relationships with lucrative DSPs.

The publisher and its demand partners end up becoming patsies for LNKR’s bad deeds, because with these malicious extensions… The malware is coming from inside the browser!

A greater danger

Of course, this confusion damages relationships between AdTech platforms. (And let’s face it, they already have serious trust issues). But beyond that, it muddies the waters for malware hunters. More and more innocuous ads are falsely labeled malvertising. This distracts ad quality providers from the job of tracking down the real bad apples—which are always employing clever new evasive measures to avoid detection.

LNKR also represents more of a danger to consumers beyond a malware delivery channel. The browsing of infected users can be tracked and LNKR can also grab search parameters when a user employs any kind of search engine. LNKR has already exhibited the ability for advanced microtargeting. It can infect actual web pages where a user has write access, enabling it to spread to additional users.

Worse, information from infected browsers—as well as access to them—is sold on the dark web to malevolent actors with more malignant schemes. Indeed, LNKR is a key player in the ransomware ecosystem. It’s an ideal tool for extracting personal data that can be exploited for great harm.

Consumer awareness is critical

*Distinct LNKR incidents, with each one accounting for thousands of individual hits, have been on the rise since the beginning of 2021.*

LNKR is an effective malvertising tactic. The number of incidents (which can account for thousands of individual hits) detected by The Media Trust has been swelling since the beginning of 2021. Nipping this ever-growing threat in the bud relies on something that’s long been difficult for the digital advertising industry: consumer education.

Browser extensions are sticky. And consumers often forget what they’ve actually installed. Unused extensions can easily pile up and extension apathy is exactly what the bad actors behind LNKR prey on. That’s where the smudgy glasses issue hits full stride: infected consumers keep getting hit with redirects. They also have no idea that a browser extension causes the issue, let alone which specific extension.

Alongside software updates, operators of the main browsers often prompt users to check their extensions to make sure they’re only housing ones they want. In addition, users need to keep their approved extensions updates—not always a simple task. But older versions of extensions can have unseen vulnerabilities and be compromised.

The rest of the industry needs to spread the truth wherever possible. We must explain that LNKR is a bigger threat than just some annoying redirects. Extension hygiene may not be sexy, but it’s key for an overall good experience on the web and helping you stay clear from malware and unwanted data tracking.

Cleaning up the LNKR smudge

Publishers, though, need to demand more from their bad-ad-blocking services. Ad quality providers must be able to identify LNKR and confirm blocks are not false positives, discount LNKR from bad-ad counts. In addition, the creative blocker needs to ensure it’s stopping the delivery of adware that will further spread the LNKR menace. That’s right: They must block pop-ups, scams, and ads distributing unwanted programs.

Finally, being able to recognize LNKR and alert publishers’ upstream partners ensures less legit creative gets caught in the crossfire. Discounting LNKR in malware reports will limit ire between AdTech partners that could eventually impact publisher revenue.

In real life, a little microfiber cloth makes quick work of a blemish on your glasses. Unfortunately, wiping browsers of the LNKR smudge is going to be a complex, industry-wide struggle. The first step, however, is widespread acknowledgement of the danger at hand.

Advertising | Perspectives

Why don’t publishers stand up for their brand integrity?

May 18, 2021 Gavin Dunaway, Product Marketing – The Media Trust

Around Halloween 2019, I was catching up on politics on a major news publisher’s site when an image in a 970X90 banner ad stopped me dead in my scrolling. I flashbacked to anatomically accurate depictions of female genitalia shown in junior high sex education class. Except this genitalia appeared to be sitting on top of a person’s neck.

This mask was graphic. But I could not look away or resist the urge to click. Yes, I took the risk that the same ad might follow me across the web for weeks. (Beware: the retargeting curse…)

“Full-head clam shell mask” blared the landing page title. A side angle revealed a harmless sea shell that someone was wearing atop of their head. Front and center, however? Female anatomy, and definitely an intentional resemblance.

At the risk of being called a prude, I can’t imagine most people would enjoy being subjected to a “clam shell mask” ad while perusing the news. And I know publisher revenue folks would be horrified if this image appeared in front of their audiences. I can just imagine the screams from the editorial team.

Out of publisher control

Brand safety conversations too often focus on advertiser concerns when publishers are trying to shield consumers from offensive or harmful creative. As this ad proved, a premium publisher was serving me a tasteless ad. Yet, my curiosity was piqued—how did this explicit mask end up in front of me? If that was targeted advertising, what ever did I do online to make an advertiser make me think I’d want to purchase that?

The ad had been served by a well-known retargeting firm, though I’d never visited the site in question. Investigation revealed the same site also sold a variety of guitar equipment, something for which I’m very much the target market. So I was most likely part of a lookalike pool .However, the advertiser or its DSP had been careless in selecting relevant creative.

Which brings up the conundrum—did the publisher have any control over the creative in that situation? Thanks to real-time bidding, no one on the revenue team had any clue that specific creative was going to give me nightmares.

Sure, advertisers can use the IAB Content Taxonomy to pre-declare ad content. But if you’re serving a huge amount of creative dynamically—like a clam shell head mask—are you really going to spell out what might offend the end user?

Publishers and supply-side platforms are forced to have a lot of faith that their upstream partners (DSPs and buying platforms). The assume they are looking out for their best interests and complying with their acceptable creative policies. All too often, that faith is unwarranted and unwanted creative sails through the programmatic pipes. Publisher reputation and user experience is damaged, but the ultimate victim is the end user.

Brand safety goes both ways

I thought about the clam shell mask when I was reading the new brand safety report from the Global Alliance for Responsible Media (GARM), a World Federation of Advertisers initiative. Analyzing content across seven major social media platforms including Facebook, Instagram, Twitter, and YouTube, GARM discovered that more than 80% of the 3.3 billion removed posts fell into the categories of Spam, Adult & Explicit Content, and Hate Speech & Acts of Aggression.

That’s certainly alarming, but it’s only one side of the coin. When the ad industry talks about brand safety, it’s accepted that we’re referring to advertiser concerns about offensive web content.

However, publishers are brands too. Also, keeping publisher brands safe from offensive advertising is also protecting consumers. This is particularly important when publishers monetize through the open programmatic marketplace. In this case, they have limited control over the kinds of creative that shows up on their sites. (E.g., disturbing clam shell masks!)

Categorically bad ads

*Of the 1 million-plus sensitive creatives identified by The Media Trust, more than two-thirds were Adult and Provocative ads.*

The Year in Sensitive Creative, a report from The Media Trust analyzed objectionable ads between March 2020 and February 2021. It reveals that nearly two thirds of the over 1 million creatives singled out were Adult (nudity, sex toys, adult entertainment) or Provocative (sexually suggestive content, profane language) ads. Other high risk categories include Alcohol and Political (big spike in inflammatory ads in October 2020). Another is Weapons, which has been on a disturbing incline since the November 2020 elections.

Bad creative goes beyond serving someone an ad with nudity or inflammatory subject matter. According to the report, nearly half of the ads related to coronavirus over this period were outright scams. These ranged from price-gouging on PPE to false or unverifiable claims about masks, air filters, and sanitizers. That isn’t just a risk to user experience. It’s also a safety concern for consumers being preyed upon by bad actors. On top of that, publishers face legal liability in heavily regulated categories such as Medical or Pharmaceutical.

*Overall, scams made up 47% of all coronavirus-related creative, but during summer 2020, that share was closer to two-thirds, putting consumers at high risk.*

Publishers have long been the last line of defense in protecting consumers from bad ads—particularly when it comes to malware and malvertising. DSPs and buying partners have shrugged off their responsibility in keeping consumers safe from objectionable ads and outright scams, all while watching revenue roll in.

Embracing responsibility

The good news is that many upstream partners like DSPs are starting to recognize the importance of complying with publisher creative policies. They are also realizing their responsibility in protecting consumers. Ensuring a high-quality ad experience is increasingly seen as good for business for buy-side platforms. So, they’re using AI-powered categorization systems to identify potentially offensive creative at scale.

The amount of creative violations detected in the second half of the period analyzed in “The Year in Sensitive Creative” was markedly lower than the first half. In particular, the amount of Adult creative has fallen 73% since November 2020. This suggests that advertisers either switched tactics or moved onto less stringent platforms.

But that’s still a problem. Too many unsavory AdTech providers are willing to look the other way on publisher brand safety. Leaving consumers vulnerable to offensive and manipulative ads should be unacceptable. This is particularly true given that technology to identify sensitive creatives at scale is readily available. It’s time all upstream AdTech companies are held accountable for the creatives they let loose in the programmatic ecosystem—such as disturbing full-head clam shell masks.

I’m afraid I can’t find the screenshot I took of that graphic mask… But trust me, you don’t want to see it.

Advertising | Industry-Research | Perspectives

When Apple closes a door, malvertising opens a window

February 17, 2021 Gavin Dunaway, Product Marketing – The Media Trust

A lot of mobile app developers are looking toward March and sighing something along the lines of: “It’s been fun, but the salad days are coming to a close.”

As promised in the iOS14 update, Apple will begin enforcing the user consent requirement for apps to share its Identifier for Advertisers (aka IDFA) in March. This was delayed from September; however, it’s been a dark cloud rapidly approaching for anyone advertising or monetizing in the mobile app space.

IDFA was a giant boon to mobile advertising. Arguably, it kick-started in-app programmatic by enabling cross-app targeting and measurement for advertisers similarly to the way third-party cookies function in browsers. While third-party cookies are (reportedly) hitting the end of the road in 2022, Apple’s IDFA will live on. However, advertisers, adtech companies, and publishers alike are pessimistic about the percentage of users who will opt-in due to a rather negative permission window from privacy-centric Apple.

Eric Seufert, who has become somewhat of an IDFA whisperer with his Mobile Dev Memo blog, predicts that only 20% of app users will opt in to sharing IDFA. While Facebook and Google are both expected to take billion-dollar revenue hits in the next 12 months due to the privacy switch, this will be a calamity for app developers of all shapes and sizes.

Unfortunately, those developers may get hit with a double whammy. They face severe revenue loss and a storm of malvertising and malicious ads taking advantage of a drooping programmatic marketplace and mobile vulnerabilities.

Publishers’ incessant mobile troubles

Mobile has been a long, hard road for digital publishers. As more and more of their traffic creeped over to smartphones and tablets during the last decade, publisher revenue opportunities dwindled. Less screen real estate was available to show display ads, visitors scrolled by impressions at warp speed, and the available formats not only failed to satisfy advertisers, but also alienated audiences.

And that was before Apple’s Safari, the most widely used mobile browser in the US, introduced Intelligent Tracking Protection (ITP) and cut off third-party cookie support. Eventually, Apple plans to put even tighter restrictions on first-party collection.

At AdMonsters Publisher Forums, ad ops professionals described their mobile web environments like ghost towns. “Oh yeah, the advertisers know that iOS users skew more affluent and that we have solid first-party data segments. But they won’t bite without client-side measurement capabilities and attribution.”

Scammers step in

No surprise then that the scammers saw a weak mobile programmatic marketplace and came to play. The current age of ad quality challenges started with omnipresent mobile redirect campaigns. For a while in 2018, it seemed like every weekend you could be greeted by scam announcements that you’d won a gift card if you dared to brave the mobile web.

Much has changed since then. Publishers have creative blockers at the ready for redirect barrages. But bad actors now seem to be favoring malicious clickbait slathered in cloaking code over the ol’ redirect.

And their interest in compromising mobile users has only grown. The biggest named malvertising threats of 2020, including LuckyBoy and IceP i ck, used fingerprinting to pinpoint mobile devices.

Late 2020 and early 2021, The Media Trust saw a dramatic rise in malicious ads on mobile devices. (And when we refer to an incident, we mean a specific malvertising campaign; the amount of infected impressions is exponentially higher.)

Malicious advertising on mobile—web and apps—skyrocketed at the end of 2020 and beginning of 2021.

As Pat Ciavolella, Digital Security and Operations Director at The Media Trust, explained on a recent webinar, “Mobile is a juicy target for bad actors…. Most people access the Internet through their mobile devices and malvertising is harder to detect. Malicious actors are starting there to make sure their code is working before expanding onto desktop and reaching anyone and everyone.”

A significant slide in in-app programmatic CPMs—due to unidentifiable or unmeasurable traffic— will simply open up new testing grounds for malvertisers.

Double whammy

So, the enforcement of consent for IDFA—with Apple messaging that’s likely to dissuade users from opting in—couldn’t come at a worse time. As noted elsewhere, even rosy opt-in predictions could have devastating consequences on app developers’ revenue. We know because we’ve seen how advertisers pull out when users are unidentifiable and unmeasurable on Safari. (On mobile and desktop).

And when benign advertisers step back, we’ve then seen how the malevolent ones step forward. A simple examination of the rise in malicious advertising during the early days of the pandemic is enough to set your hair on end. An explosion in supply with lowered CPMs is a scammer’s paradise. The scam opportunities around Covid will once again hit fever pitch as bad actors try to capitalize on vaccine distribution.

*Rise in malicious advertising detected between Jan. 2020 and April 2020—the beginning of the Covid pandemic.*

App developers face a dual threat. First, the are likely to see a serious drop in revenue as in-app programmatic CPMs decline when users fail to opt-in to IDFA-sharing. And then a host of bad advertisers will try to infect their users with malware or rope them into some kind of scam.

As tempting as it may be to send the programmatic bid floors to the basement, app developers – and mobile publishers in general– have to keep their guards up against malvertising. The must also demand better protections from their upstream demand partners. It’s never been more important to scan and track where bad ads are coming from.

In the long run, infecting your users with malware or a credit card skimmer could have far worse ramifications than a revenue shortfall.