The Top Search Result Isn't Always the Real Site
Scammers buy search ads on trusted brand names so their fake page appears above the real one. How malvertising works and the habits that protect your team.
When you search for a program to download or a site to log into, the first thing you see is usually an ad. It sits at the top, marked “Sponsored,” and most people click it without a second thought, because the top result is normally what you wanted.
Scammers count on exactly that. They buy search ads on the names of trusted companies and popular software so their fake page appears above the real one, and busy people click through assuming it’s official.
How the scam works
The technique is called malvertising, short for malicious advertising. An attacker buys a search ad for a term people trust: a bank’s name, “Microsoft 365 login,” or a common utility like a PDF reader. The ad looks normal, with the real brand name and a plausible-looking address.
Click it, and you land on a page built to look exactly like the real one. Sometimes it asks you to log in and sends your username and password straight to the attacker. Sometimes it offers the software you wanted, and the download installs malware alongside it, or instead of it.
Ad networks do review ads, but attackers have learned to show a clean, harmless page to the reviewers and the malicious one to everyone else. Scale tells the story: Google’s 2025 Ads Safety Report describes blocking or removing more than 8.3 billion ads, suspending 24.9 million advertiser accounts, and taking down 602 million scam-related ads, and notes criminals now use AI to produce fake ads faster. Plenty still get through. Researchers have found scam ads impersonating everyday tools like VLC, 7-Zip, and CCleaner, delivering password-stealing malware to people who just wanted a video player.
Where this bites a business
Two routine situations carry most of the risk:
- Downloading software. An employee searches for a tool, clicks the top ad, and installs an “installer” that quietly steals every password saved in their browser.
- Logging in. Someone searches “Microsoft 365 login” or the company bank’s name, clicks the ad instead of the real link, and types their credentials into a replica page.
The common thread is info-stealing malware. Once it’s on a machine, it can lift saved passwords, browser cookies, and session tokens, which can let an attacker into accounts even when MFA is turned on, because they’re stealing an already-authenticated session rather than guessing a password.
The habits that prevent it
- Scroll past the sponsored results. The real site is usually one or two results below the ads.
- Never download software from an ad. Type the vendor’s address yourself or use the organic result, then download from the official site.
- Bookmark the sites you log into. For banking, Microsoft 365, and other critical accounts, a saved bookmark beats searching every time.
- Keep browsers and devices updated so a bad download has fewer ways to succeed.
- Tell your team this exists. Most people genuinely don’t know the top result can be a trap. Once they know, the habit fixes itself.
DNS and web filtering adds a safety net behind those habits, blocking known malicious destinations even when someone does click. It’s one of the layers we include in managed security for exactly this reason: good habits do most of the work, and filtering catches the exceptions.
If someone already clicked
Visited the page but entered nothing? Close it; no harm done. Typed a password? Change it now and confirm MFA is on. Downloaded and ran a file? Disconnect the machine from the network and have it checked for info-stealing malware before anyone uses it again.
If you’re not sure what’s standing between your team and a convincing fake login page, a short security review will show you, in plain language, without the scare tactics. Talk with us to set one up.