Summary: Scammers buy ads on Google and other search engines using the names of trusted brands and software, so their fake site shows up at the very top, above the real one. Click it and you can land on a fake page that steals your login or installs malware. You can avoid nearly all of it by skipping the sponsored results and going to the real website yourself.
When you search Google for a program to download or a website to log into, the first thing you see is usually an ad. It sits at the top, marked “Sponsored,” and most people click it without a second thought, because the top result is normally what you wanted.
Scammers count on that. They buy ads on the names of trusted companies and popular software, so their fake site appears right at the top, above the real one, and you click it thinking it’s the official page.
How the scam works
The trick is called malvertising, short for malicious advertising. A scammer buys a search ad for a term people trust, like the name of your bank, a Microsoft login, or a common program such as a PDF reader or a video player. The ad looks normal, with the real brand name and a web address that looks right.
When someone clicks it, they land on a page built to look exactly like the real one. Sometimes that page asks you to log in and hands your username and password straight to the scammer. Other times it offers the software you were after, and the download installs malware instead of the real program.
Why these ads are so easy to fall for
These ads are convincing. They sit above the real result, so they’re the first thing you see. They use the real company’s name and a web address that looks right. And they show up on a search you started yourself, so they don’t feel as suspicious as a random email or text would.
Attackers have also gotten good at hiding from the checks meant to stop them. They show a clean, harmless page to the ad reviewers and the real, malicious page to everyone else, so the ad can pass review and still do damage.
How common is this?
Very. In its 2025 Ads Safety Report, Google said it blocked or removed more than 8.3 billion ads that broke its rules, suspended 24.9 million advertiser accounts, and took down 602 million ads tied to scams. Google also noted that criminals are now using AI to make fake ads faster.
Security researchers have found scam search ads pretending to be well-known programs like VLC, 7-Zip, and CCleaner, and even Google’s own apps, with downloads that installed password-stealing malware. These show up on the everyday searches your team runs.
What this means for your business
For a business, the risk comes up in two everyday situations: downloading software, and logging in.
When someone downloads software, they search for a tool, click the top ad, and install something that steals the passwords and logins saved in their browser.
When someone logs in, they search for “Microsoft 365 login” or their bank, click the ad rather than the official link, and type their username and password straight into a fake page.
In both cases, the problem is info-stealing malware. Once it’s on a machine, it can steal saved passwords, browser cookies, and session tokens, which can get an attacker into accounts even when multi-factor authentication is switched on.
How to protect your team
- Scroll past the sponsored results. The ads sit at the top, marked “Sponsored” or “Ad.” The real website is usually just below, in the normal results.
- Don’t download software from an ad. Type the maker’s web address yourself, or search and use the normal result, then download from the official site.
- Bookmark the sites you log into. For your bank, Microsoft 365, and other important accounts, use a saved bookmark instead of searching each time.
- Keep devices and browsers updated. Turn on automatic updates so a bad download is less likely to work.
- Tell your team this is a thing. Most people have no idea the top result can be a trap, and once they know, they stop clicking it.
Frequently asked questions
Aren’t ads at the top of Google checked and safe?
Google reviews ads and removes billions that break its rules, but scammers still slip through by showing reviewers a clean page and everyone else the malicious one. A “Sponsored” label doesn’t mean the site is safe.
What is malvertising?
Malvertising is short for malicious advertising: scammers buy online ads, often on trusted brand names, to send people to fake sites that steal logins or install malware.
How do I download software safely?
Go to the maker’s official website by typing the address yourself, or search and use the normal (non-ad) result. Don’t download from a sponsored ad, and don’t trust a download that arrives through one.
What should I do if someone clicked a scam ad?
If they only visited the page, close it and don’t enter anything. If they typed a password, change it and turn on MFA. If they downloaded and ran a file, disconnect the device and have your IT provider check it for info-stealing malware.
Does an ad blocker help?
It can. A reputable ad blocker hides many sponsored results, which takes the fake links off the page before anyone can click them. It isn’t a complete fix, so keep the habits above too.
Sources and further reading
- Google: 2025 Ads Safety Report — Google’s own figures on the scale of scam and policy-breaking ads.
- FTC: Online search results — the good, the bad, and the scammy — US consumer guidance on scrolling past ads and downloading software safely.
- BleepingComputer: Malware pushed via Google search ads for VLC, 7-Zip, CCleaner — a real example of scam ads impersonating popular software.
If you’d like to give your team a plain rundown of what a scam ad looks like, or tighten how software gets installed on your computers, your IT provider can help with both. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.
—
This Article has been Republished with Permission from The Technology Press.
