Malware
Malvertising
Malvertising is malware delivery through paid ads. The ad slot looks normal; the creative, or the landing page it points to, carries the attack.
How it is measured
Count what happened, not impressions: the ad request, the creative's iframe chain, and any redirect that leaves the ad network's domains. The browser network panel or an ad-verification scanner shows the hosts called after the click, or even before it. Auto-redirect creatives fire with no click at all.
Because bad creatives are rotated in by auction, one load can be clean and the next hostile. Capture many loads from different regions and devices, and keep the HAR file. A single clean test proves very little.
Worked example
A news site running programmatic ads gets reports that iPhone users in Texas are bounced to a fake prize page about four seconds into article pages. The network log shows a creative from a small demand partner loading an iframe that sets top.location without a user gesture.
The ops lead blocks that partner's seat ID in the ad server and the redirects stop. The ad log shows the creative served about 600 times over six hours before anyone caught it.
How it differs
An exploit kit is the server-side toolbox that probes a browser and picks a vulnerability to use. Malvertising is one way of getting a visitor to that kit, or of showing scam content directly. An ad can deliver a fake update with no exploit, and an exploit kit can be reached with no ad at all.
Common errors
Blaming the site's own code first. Testing one page load and calling it clean. Reproducing with an ad blocker on, so the creative never loads. Forgetting that a creative can arrive through resellers several hops from your contract. Leaving ad iframes without sandbox attributes.
In practice
Ask your ad provider how to ban a seat or advertiser quickly and which categories you can block. Put ad slots in sandboxed iframes without allow-top-navigation, and reproduce reported incidents in a clean browser profile with no blocker. Keep screenshots and HAR files so the network can trace the creative.