Malvertising

Malvertising hides harmful code or links inside what looks like a normal ad. It may push a fake "your device is infected" warning, redirect the browser to another site without a click, or install unwanted software. Honest publishers can carry it unknowingly, because the ad arrives through an automated chain.

It connects to search arbitrage in three ways. Forced redirects from malicious ads are one source of the junk visitors that some networks sell as cheap pop traffic or domain redirect traffic. Malware installed this way is how devices join a botnet or get adware and search hijackers. And an arbitrageur's own lander can be hit if it runs third-party ad units alongside the feed.

Google Ads' policies prohibit malicious software and compromised destinations and treat them as grounds for immediate suspension. Signs that a traffic source is tied to malvertising: visitors who arrive and leave within a second, no scroll or touch activity, and referrers from ad-serving domains instead of pages.

Defence for publishers is creative scanning and blocking. ClearTrust's PubTrust is a product in this category, protecting publishers' ad quality against malvertising.

Think of it like this

It is a poisoned sample handed out at a supermarket by someone wearing a convincing uniform. The shop did not make it, but the shop's customers are the ones who get ill.