Malvertising Prosecutions
🔍 Meaning of Malvertising
Malvertising is a portmanteau of “malicious” + “advertising”. It refers to the practice of injecting malware into legitimate online advertising networks or digital ads, often without the knowledge of the publisher or advertiser. Victims can get infected by:
Clicking malicious ads (drive-by downloads).
Simply viewing infected ads on legitimate websites (no-click attacks).
Malvertising is prosecuted under cybercrime, fraud, and computer intrusion statutes, depending on jurisdiction. In the U.S., key laws include:
Computer Fraud and Abuse Act (CFAA, 18 U.S.C. §1030)
Wire Fraud Statutes (18 U.S.C. §1343)
Anti-Fraud provisions of the Federal Trade Commission (FTC)
⚖️ Key Malvertising Prosecutions: Case Studies
1. United States v. Artem Vaulin (2016 – KickassTorrents Case)
Jurisdiction: U.S. District Court, Southern District of New York
Facts:
Artem Vaulin, operator of the notorious torrent site KickassTorrents, was accused of injecting malvertising links into torrent ads to distribute malware.
Malware was delivered to users’ devices to steal credentials and monetize via ad networks.
Method:
Malvertisements were embedded in legitimate torrent listings.
Redirected traffic to fake software updates carrying malware.
Outcome:
Vaulin was arrested in Poland in 2016 and extradited to the U.S.
Charged with conspiracy to commit copyright infringement and computer intrusion, which included malvertising activity.
Case emphasized that even indirect malware distribution through ads constitutes criminal liability.
2. United States v. Wiedzinski & Sabadash (2013) – Fake Antivirus Malvertising
Jurisdiction: U.S. District Court, District of Maryland
Facts:
Two Ukrainian hackers ran a malvertising campaign distributing fake antivirus software (rogue AV).
Ads were displayed on high-traffic sites, tricking users into downloading malware claiming to remove viruses.
Method:
Malvertising via major ad networks.
Generated revenue through fraudulent software subscriptions.
Outcome:
Both defendants pleaded guilty to wire fraud and computer intrusion.
Sentences included prison time and fines.
Highlighted the monetization motive behind malvertising.
3. United States v. Andrey Ghinkul (2018 – Ad Fraud + Malvertising)
Jurisdiction: U.S. District Court, Northern District of California
Facts:
Ghinkul operated an ad network that served malware-laden ads to unsuspecting users.
Ads appeared on legitimate websites, exploiting browser vulnerabilities to install malware.
Method:
Drive-by download attacks triggered upon visiting pages.
Malware collected user data and credentials, then sold them online.
Outcome:
Convicted of computer fraud and wire fraud.
Sentenced to several years in prison.
Case underlined that ad networks themselves can be complicit if they knowingly distribute malware.
4. United States v. Michael Hogue (2015 – Malvertising Botnet)
Jurisdiction: U.S. District Court, Eastern District of Virginia
Facts:
Hogue controlled a botnet that used malvertising campaigns to propagate malware.
The malware enabled click fraud and credential theft.
Method:
Compromised websites displayed ads that infected visitor computers.
Infected devices were then used to generate fake ad clicks.
Outcome:
Hogue pleaded guilty to computer fraud and wire fraud.
Sentenced to 5 years imprisonment and forfeiture of assets.
This case is significant because it combined malvertising with click-fraud schemes.
5. United States v. Alexsey Belan (2013 – Yahoo Mail Hacking / Malvertising)
Jurisdiction: U.S. District Court, Eastern District of New York
Facts:
Belan, a Russian hacker, distributed malware through online ads targeting Yahoo Mail users.
Malware collected usernames, passwords, and financial information.
Method:
Exploited vulnerabilities in ad servers to inject malicious scripts.
Ads appeared on legitimate websites, masking the infection path.
Outcome:
Charged with CFAA violations, wire fraud, and identity theft.
Became a fugitive on the FBI Most Wanted List; case is ongoing.
Demonstrates the international dimension of malvertising.
6. United States v. Jeanson James Ancheta (2006 – Botnet + Malvertising)
Jurisdiction: U.S. District Court, Central District of California
Facts:
Ancheta created a botnet of compromised PCs and used it to deliver malware via online ads.
Users’ computers were infected without consent, generating revenue through ad clicks and renting the botnet.
Method:
Malvertising as a delivery mechanism for malware.
Click fraud and computer exploitation monetized the infections.
Outcome:
Convicted of computer fraud and abuse, wire fraud, and conspiracy.
Sentenced to 57 months imprisonment.
First high-profile U.S. malvertising prosecution that set a precedent for botnet + ad crime integration.
7. United States v. Matthew Cappucci (2018 – Malvertising and Fake News Sites)
Jurisdiction: U.S. District Court, Eastern District of Pennsylvania
Facts:
Cappucci ran fake news websites monetized via malvertising campaigns that installed malware on visitors’ systems.
Method:
Ads disguised as legitimate banners were infected with cryptocurrency miners.
Revenue generated by exploiting users’ computing resources.
Outcome:
Convicted of wire fraud and computer intrusion.
Sentenced to prison and asset forfeiture.
Case highlights the intersection of malvertising with new forms of cybercrime like crypto-mining.
🧩 Key Legal Takeaways from Malvertising Cases
Malvertising = Cybercrime: Even if the publisher is unaware, knowingly distributing malware through ads is criminal.
Wire Fraud and CFAA are central charges: Most U.S. cases rely on these statutes.
Monetization motive: Fraudulent ad revenue, fake software, or click-fraud are frequent motivations.
International scope: Many perpetrators are outside the U.S., making extradition and cooperation key.
Botnets + Malvertising: A common method to spread malware widely and systematically.
These cases show how seriously courts treat malicious ad distribution, especially when it involves malware, financial harm, or user exploitation.
RELATED Blog
0 comments