The advertising world has long been plagued by bad actors, but today’s online landscape is overrun with a new breed of deceptive and bizarre clickbait ads. In this article, we unravel the mystery: How do clickbait ads infiltrate websites and what is their effect on user experience?
What are clickbait scam ads?
One of the ways that fake information penetrates publishers’ websites is through what’s known as a clickbait ad. In fact, the borders that once distinguished malicious advertising from low-quality ads or misleading ads have blurred to the point where it’s hard to say where one ends and the other begins. Internet scammers who once relied on malicious code to force users into their traps have turned to clickbait ads scams and fake news to deceive users.
Clickbait ads live up to their name by luring users with creative text and visuals designed to compel them to click. Whether it’s a celebrity gossip story, a miracle cure, or a seemingly legitimate browser notification, these ads prey on users’ curiosity and trust. The real deception only becomes clear after the user clicks, making it difficult to detect and avoid these scams.
Publishers are greatly affected by clickbait ads as users struggle to distinguish between the actual content on the publishers’ website, such as news stories, articles, and blogs, and the content of the ads placed within the ad slots. When users have a bad experience on the publishers’ sites, they blame the publisher in the same way, whether the poor experience occurred while they were reading an article or when they clicked on an ad.
With clickbait ads becoming increasingly deceptive, publishers must ally with a trusted ad security partner to safeguard their websites from a variety of attacks. Our detection systems have identified ten clickbait scams that occur after the user clicks on the ad, providing precise terminology and finer granularity to pinpoint the deceptive techniques GeoEdge scans for on publishers’ websites.
Clickbait scam advertising examples
1. Forced browser notifications
Forced browser notification scams offer users access to video content and web streaming services, often focused on adult content. These clickbait ads lead users to accept push notifications from a malicious website. Once users allow notifications, the scammer gets an open, un-monitored channel to bombard the user with visual messages with call-to-action buttons on their browser.
2. Malicious Extensions & Add-ons
This scam relies on button-like creatives that lead users to a landing page where they are prompted to install fake extensions and add-ons to their browsers by offering incentives like access to video content, streaming services, PDF conversion tools, and more.
Once users install these add-ons, scammers can access their online activity and collect information about anything they do on their browsers and on all the sites they visit.
Learn more about how it works and how to protect your users against it here – Malicious Browser Extensions
3. Fake Antivirus & Cleaners
Fake antivirus and cleaners are a good example of attacks that use scare tactics. Disguised to look like a system notification, these ads tell the user that they have a virus or malware infection on their device and need to take urgent action.
Users are then prompted to download and install phony antivirus or computer cleaning software, which are actually malicious programs. These messages appear on the creative or popup after the user clicks on a legit-looking ad and trick consumers into downloading malware onto their computers.
Understand how it works and how to secure your users from it here – Fake Antivirus Software
4. Fake Software Update
These attacks use a fake message telling users that they need to update some kind of software on their computer. They usually contain social engineering components such as icons and logos well-known companies like Google, Apple, or Adobe, designed to make the user think the message was prompted by their system or a service provider they trust. The fake message tells users that they have software on their device that requires an update, prompting the users to download and install their disguised malicious programs.
Get an in-depth understanding of how it functions and how to protect your users from it here – Fake Software Updates
5. Suspicious VPN
Suspicious VPN attacks present users with a fake error message prompting them to install a VPN to secure their online activity on all sites they visit. The VPN software installed by the users often functions as a proper VPN, but in parallel, it also tracks the user’s online behavior on all sites or engages in illegal data collection.
Learn more about the mechanics and how to safeguard your users from it here – Malicious VPN Scams
6. Gift Card Scam
Like other types of phishing scams, gift card advertising scams trick users into providing personal details to win a prize. They usually use either fake survey scams or fake lottery scams to lure consumers into clicking on their ad with the hope of winning a prize. Fake user comments on the landing page the ad leads to are designed to further disguise the scam.
7. Tech Support Scam
Tech support scams are effective because they combine several elements that create a strong impact on the user. Fraudsters use innocent-looking ads that appear to be helpful. However, they are actually clickbait ads, and as soon as a person clicks on the link in the ad, scammers brutally take over the entire screen while disabling basic browser features like the user’s ability to exit full-screen mode or close the browser tab.
These types of clickbait ads often use icons and logos of well-known tech companies like Apple, Google, and Microsoft to make the message appear to be a system alert. They often add strong red colors to create a psychological impact and a sense of urgency (social engineering). They tell horror stories about a critical malfunction or virus, and offer a what looks like a clear path to solve the problem. However, they are actually leading users to download and install a fake program or call a fake support center that will guide the user to install the malicious code or simply phish personal data to scam people.
Gain knowledge on its function and how to protect your users from getting exposed to it here – Tech Support Scams
8. Financial Scam
A financial scam usually starts with scammers pretending to be legitimate advertisers, buying media for a legitimate campaign. In this “warm-up stage,” the scammers gain the trust of ad networks and DSPs and receiving approval for harmless ads and landing pages. Once scammers are approved, the scam is revealed and the social engineering work will kick in as the ad tags return a clickbait ad.
Financial scams often exploit the popularity of a local celebrity (without their consent) along with a shocking clickbait headline or story designed to lure users into clicking the ad. Once the ad is clicked, the user will be redirected to a deceptive landing page that will usually mimic a trustworthy news website containing a fake article promoting a phony offer or financial service such as cryptocurrency or stock exchange trading, with no real company or vendor behind it. The landing pages on these websites are built so that any clickable element in the article leads the user to the deceptive offer page, where they are asked to fill out a form providing personal information and credit card details to register for the service.
9. Brand Infringement
Brand infringement ads implement ads for fraudulent, low-quality, non-genuine products or non-existent products and services. This may include counterfeit products, campaigns impersonating brands or companies by referencing or modifying the brand content in the ads, URL, destinations, or misrepresenting themselves as the brands or businesses. Clickbait ads and landing pages like these typically promise premium products at unusually low prices.
10. Misleading Product Offers
Misleading product offers use clickbait ads and landing pages that market products that don’t really exist such as miracle cures or non-genuine products like brand knockoffs. Clickbait ads in this category prey on users’ hopes and fears, offering easy solutions for complex problems, products, or services in scant supply.
How do clickbait scammers make money?
Clickbait ads use a variety of tactics to earn money. They often lead victims to install something on their computer that allows scammers to collect the user’s login credentials on every site they visit. When they have collected credentials from enough users on various sites, they sell the creditial lists on the darknet.
Another example of how scammers earn money is through ransom. They lead users to install malicious softare that takes over their computer or device, and then the scammers demand a ransome payment to release their device. The ransom is how they earn a profit.
In financial scams, the bad actors convince people to invest real money in what they believe is an investment. The scammers then pocket that money, which becomes their profit.
Last but not least, some scams use a victim’s computer to mine cryptocurrency. Mining is usually costly, and if scammers can use a victim’s computing power to create cryptocurrency without paying for mining, and without the victim’s knowledge, they can create a revenue stream from the cryptocurrency they create.
What are the risks of clickbait scam ads?
Like all types of malicious ads, clickbait scams are designed to steal personal information, install ransomware, or give bad actors access to your device. Once the scammers get users to install malware, it is easy for them to take advantage of the users either by selling their personal information, collecting ransom, or utilizing their computing power.
How do you spot a clickbait scam ad?
Identifying clickbait ads on their websites poses a significant challenge for publishers. Fraudsters have devised multiple tactics to bypass ad network safeguards, leaving publishers oblivious to malicious ads until users raise the alarm on social media or other platforms. In some cases, publishers remain unaware of the problem until they experience a dip in traffic on their websites, signaling a brewing issue.
GeoEdge uses advanced image and text analysis both of both the ads and the landing pages they lead to, cross-referencing the data with blocklists to pinpoint clickbait ads in real time, before the user sees them.
How to block and stop clickbait ads?
It’s simply impossible for individual publishers to monitor every single programmatic creative alone Typically, publishers only come to realize the existence of clickbait schemes after they’ve already inflicted damage on their visitors, causing them to suffer negative repercussions on their website.
Keep your site safe and protect users by partnering with an ad security solution like GeoEdge
