# Malvertising: When the Top Search Result for Zoom or Teams Is Malware

URL: https://limehawk.io/reports/malvertising-fake-software-downloads
Published: 2026-10-02
Author: Corey Watson, Managing Member
Topic: Guides
Read time: 6 min

Malvertising is a paid search ad that impersonates real software and serves malware. If someone installed one, unplug the PC and call IT before anything else.

> **TL;DR** Malvertising is criminals buying real search ads that look like Zoom, Teams, AnyDesk, or whatever you typed, then sending you to a lookalike site with a malware installer. The FBI warned about it in December 2022, and Microsoft disrupted a malware-signing service in May 2026 whose customers used paid ads for fake Teams downloads to deliver ransomware. If someone in your office ran one of these installers, unplug that computer from the network, don't wipe it, and call IT. Then change passwords from a different, clean device. Long term, the fix is boring: staff aren't local admins, IT installs the software, and every machine runs EDR.

- Malware-signing certs revoked: 1,000+

## What should I do if someone already installed it?

Treat the computer as compromised and stop using it. Pull the network cable or turn off Wi-Fi, but leave the machine powered on so IT can see what ran. Don't run a "cleaner" you also found on Google, and don't wipe it yourself. Call your IT provider right away, then change passwords from a different, clean device.

Here's the order we'd want it done in:

1. **Disconnect it.** Unplug the network cable or turn off Wi-Fi. Don't shut it down unless IT tells you to.
2. **Don't wipe or reinstall.** The evidence of what ran, and what it reached, is on that disk. IT decides when it gets reimaged.
3. **Call IT now.** Say what was searched, what was clicked, and roughly when. A screenshot of the ad helps if anyone still has it.
4. **Change passwords from a different device.** Start with email, banking, payroll, and anything saved in that computer's browser. A lot of this malware steals saved passwords and logged-in sessions, so assume those are gone. Our [infostealer guide](/reports/infostealer-malware) covers why.
5. **Watch the money.** If that PC touches banking or wires, call the bank and tell them. Verify any new payment instructions by phone, the way our [wire verification guide](/reports/how-to-verify-wire-instructions) describes.
6. **Don't pay anyone** who pops up asking for money to "fix" it.

If you don't have a plan written down for this yet, start with our [incident response plan template](/reports/incident-response-plan-template).

## What is malvertising?

Malvertising is malicious advertising: a criminal buys a real ad on a search engine so it shows up above the real result. The ad looks like the brand you searched for. It links to a copycat site with a download button, and the file is malware. Nothing about the ad itself is hacked. They paid for the spot.

The FBI described exactly this in a December 21, 2022 public service announcement, [Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users](https://www.ic3.gov/PSA/2022/PSA221221). It says criminals "purchase advertisements that appear within internet search results using a domain that is similar to an actual business or service," and that the fake page "has a link to download software that is actually malware." The PSA calls out ransomware as one of the payloads.

The FBI repeated the warning in an [April 24, 2025 PSA](https://www.ic3.gov/PSA/2025/PSA250424), this time about fake ads for employee self-service and payroll logins that steal credentials. Same trick, different bait.

## Which software do they impersonate?

Anything people search for by name instead of getting from IT. Microsoft has documented fake installers for Zoom, AnyDesk, TeamViewer, Teams, PuTTY, and Webex across two campaigns. Remote access tools and meeting apps show up a lot because people need them in a hurry, usually because a client just sent a meeting link.

- In November 2022, Microsoft wrote that a group it tracks as DEV-0569 ran a [malvertising campaign using Google Ads](https://www.microsoft.com/en-us/security/blog/2022/11/17/dev-0569-finds-new-ways-to-deliver-royal-ransomware-various-payloads/). It pushed fake installers for TeamViewer, Zoom, AnyDesk, and Adobe Flash Player, and the chain led to Royal ransomware.
- On May 19, 2026, Microsoft published its [disruption of Fox Tempest](https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/), a service that sold criminals code-signing so malware would look like legitimate software. Microsoft says one customer, the ransomware group it calls Vanilla Tempest, spread signed fake Teams installers "through legitimately purchased advertisements that redirected users searching for Microsoft Teams" to fraudulent download pages. The post names fake AnyDesk, Teams, PuTTY, and Webex files. Microsoft revoked 1,000+ certificates tied to the service and, per its [legal announcement](https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/), seized the service's website and filed suit in federal court in New York.

That second one matters for small offices. The installer had a valid-looking signature. "It was signed" is not proof it's safe.

For an accounting firm, think about what gets searched in a hurry: a screen-sharing tool for a client, a tax software update, QuickBooks. Nobody has published a campaign tied to those exact searches that we're citing here, but the method works for any name you'd type into a search box. That's why our [accounting firm IT page](/industries/accounting-firms) treats software installs as an IT job, not a staff job.

## How do I spot a fake software ad?

Look at the label and the address before you click. Paid results are marked "Sponsored" or "Ad." The real vendor's domain should match exactly, not with an extra word or a different ending. If you're about to download software, the safest move is not to search at all. Type the vendor's address or use a bookmark.

Warning signs:

- **The top result is marked Sponsored**, and you were looking for a download.
- **The domain is close but wrong.** An extra word like "download" or "install," a misspelling, or a different ending than the vendor's real site.
- **The page pushes a download immediately** and looks a little off.
- **The installer asks for admin rights** for something that normally doesn't, or the program doesn't seem to do anything after it runs.

The FBI's own advice in the [2022 PSA](https://www.ic3.gov/PSA/2022/PSA221221) is to check the URL before clicking an ad, type the address directly instead of searching, and use an ad blocker when searching. For businesses, it says to teach users where legitimate program downloads come from.

## How do we stop this next time?

Make it so staff don't need to download software at all, and so a fake installer can't do much if they try. That comes down to four controls. None of them is exotic, and together they shut down most of this.

- **Staff aren't local administrators.** A standard user account can't install system-wide software or change security settings, so a lot of fake installers stall and somebody calls IT. Some malware runs fine without admin rights, which is why this isn't the only layer. Microsoft lists least-privilege access and restricted admin accounts in its DEV-0569 mitigations.
- **IT installs software through an approved channel.** If someone needs Zoom, IT pushes it from a known source. We do this with RMM tools and package managers like winget, the way we describe in our [winget deployment report](/reports/winget-rmm-automation). Nobody goes shopping on a search engine.
- **Ad and web filtering.** DNS or web filtering blocks known-bad domains before the page loads, and blocking ads removes the bait. Neither is perfect, since new domains show up daily. That's why you want the next layer too.
- **EDR on every machine, with someone watching it.** Endpoint detection and response watches what programs do, not just what they're named, and can cut an infected PC off the network. Our [EDR vs antivirus guide](/reports/edr-vs-antivirus) explains the difference and its blind spots.

Add MFA on email and banking so a stolen password alone doesn't get anyone in, and tested backups so a worst case is a restore and not a ransom conversation. Our [3-2-1 backup rule guide](/reports/3-2-1-backup-rule) covers that part.

A related trick to know: fake "your browser needs an update" pages work the same way, just without the ad. See our [SocGholish fake browser update guide](/reports/socgholish-fake-browser-update).

## Key takeaways

- Malvertising is a paid search ad that impersonates real software. The ad sits above the real result and the download is malware.
- If someone ran a fake installer: unplug the PC from the network, leave it on, call IT, and change passwords from a different device.
- A digital signature isn't proof. Microsoft revoked 1,000+ fraudulently obtained code-signing certificates used to make malware look legitimate.
- Staff shouldn't be local admins. If IT installs the software, a fake installer has nowhere to land.
- Bookmark the real download pages and the real login pages. Typing or clicking a bookmark skips the ad entirely.

## What this looks like when we do it

On our [managed IT and security service](/services/managed-it-security), every machine gets the same baseline: EDR, monitoring, patching, email filtering, and web filtering. When someone needs a new app, the answer we want is a ticket, not a search. We push software from known sources through our RMM, the same way we do fleet installs.

If something still gets through, our critical response time is under 15 minutes. We isolate the machine, look at what ran, reset what needs resetting, and restore from backup if it comes to that. We've written up what unwanted software looks like after it's already on a fleet in our [OneStart removal report](/reports/onestart-malware-removal), and why it can get past EDR when it's signed.

If you run a CPA or bookkeeping office, our [accounting firm page](/industries/accounting-firms) covers how this fits with your WISP and the FTC Safeguards Rule. Our [managed IT and security page](/services/managed-it-security) has the full baseline.

Someone just clicked a sponsored download and you're not sure what happened? Book a call and we'll walk through it with you.