Scripts that intercept mouse clicks are being used for ad fraud or to redirect users to malicious sites, according to ZDNet’s Catalin Cimpanu:
A team of academics from all over the world has found malicious scripts that intercept user clicks on 613 of today’s most popular websites.
The practice, known primarily under the term of clickjacking, has been plaguing the advertising industry for years, with criminal groups taking advantage of it to perform hidden or unwanted clicks on online ads to boost their profits.
Some of the malicious scripts were used to intercept clicks and perform clicks on ads for monetary profit, while other scripts intercepted clicks to redirected users to malicious sites showing scareware, tech support scams, or peddling malware-laced apps.
According to data collected by the research team, most of the clickjacking scripts were included in legitimate sites as part of advertising solutions.
Researchers said the reason why these techniques are becoming rampant is because online advertisers are deploying better solutions to detect bot-generated (programmatic) clicks. As a result, criminal groups are resorting to these techniques that hijack real user clicks to perform actions that were previously performed by automated scripts or malware.
MacDailyNews Take: Hopefully, this can be combatted and solved as malvertising via third-party ad networks is the scourge of large and small publishers alike.
We, along with many other sites, just weathered a storm of auto-redirect malvertising via third-party ads networks. We killed an entire ad network (found via the process of elimination) to stop them! Visitors who are unfamiliar with how online advertising works, often blame the publishers who are not the cause of, and are therefore unable to fix, the problem. Third-party ad networks need to review every ad code submission carefully to eliminate the criminals from placing malvertising into their networks where they wreak havoc across the web. When these bad ads get through, publishers have a stark choice: turn off revenue used to run the site or drive away traffic, hoping the ad network(s) can find the bad ad out of millions and kill it.
In our opinion, all malvertisers should be drawn and quartered.
Again, we do not run pop-up ads, ever, so if you see a pop-up, please let us know at webmaster@macdailynews.com so that we can at least notify the ad networks that they have a problem (yet again).
Hilarious! Every single MDN story comes with a pop up ad from a service called Edge. And it is always the same ad. And the link to the MDN webmaster to report this went to a blank page — of course, with the same Edge pop up ad.
It’s not a link to a page, it’s an email address!
Clicking the hyperlink in the article directs to a blank page stating “page can’t be found”. With the Edge ad displayed, as Jeff noted.
@MDN: You accidentally formatted the “mailto” link incorrectly, breaking the ability to click it in order to compose an email.