You Did Not Click Anything. It did not need you to.
Reader…
You walk into an office in the Valley with a coffee in your hand. You are early for a meeting, so you ask the receptionist for the Wi-Fi password, sit down, and open Facebook Marketplace while you wait. You are not doing anything wrong. You are being productive, checking the price of a used baler, scrolling past a stock trailer, a mower, a skid steer with too many hours.
By the time your meeting starts, your phone has already been fingerprinted, located to within a few miles, and handed a listing built specifically for someone like you. You never tapped anything. That part came later.
This is a story about a real day on a real network we watch, and about a second one that happened in our own family. The business is masked, the people are masked, and the phone was never ours to protect. That last detail is the whole point.
What malvertising is
Every website you trust rents out space. A newspaper, a weather app, a marketplace, the recipe site your mother uses: none of them build their own ads. They sell the slot to an ad exchange, the exchange resells it in a fraction of a second to the highest bidder, and the winning bidder's code loads inside the page. The vetting along that chain is thin, and criminals know it. They buy ad space like any other advertiser and put their attack inside the ad.
That is malvertising. Malicious advertising. The website did nothing wrong, and neither did you. "Only visit reputable sites" stopped being protection years ago, because the reputable site is exactly where the ad gets served.
Why "I did not click anything" is usually the case
Most people think of an attack as something they let in. A bad link, a wrong download, a password typed on the wrong page. Malvertising does most of its work before any of that.
The moment the ad loads, its code is already running in your browser. Before a tap, it will:
Fingerprint your device: phone or laptop, operating system, screen size, browser version, language. A few dozen details that add up to a signature nobody else has.
Locate you. Not with GPS; it does not need permission for that. It asks a geolocation service what your internet address maps to, and it gets your county back.
Choose your bait. A phone in Imperial County in September gets farm equipment. A phone in Sacramento gets something else.
On mobile, many of these ads also force a redirect. The page you were reading simply becomes a different page. No tap. If you have ever had a site "jump" to a spam page on your phone and wondered what you touched, the answer is nothing. That is the ad. By mid-2025, forced redirects had overtaken clickbait as the leading threat even on desktop, so this is no longer a phone-only problem.
The nastier version, the true drive-by, goes further: the ad probes your browser for something unpatched and drops a payload with no human action at all. On a fully updated phone this is rare and expensive. On an old Windows machine with a stale browser, it is Tuesday. Keep your updates current; that one habit closes most of that door. If you want to know exactly what "drops a payload" means and why the old machine is the easy one, the next section opens the hood. If you would rather stay on the road, skip past it; nothing later depends on it.
Under the hood: what the drive-by actually does
A payload is just the code the attacker wants running on your machine instead of on theirs. "Dropping" it means getting those bytes out of the ad and into your device, then getting your device to run them. That is the whole game: code that was harmless data one microsecond ago becomes instructions your processor is now following.
The ad is the delivery van. Inside a malvertising ad sits a small script whose only job is to turn data into execution. The tool that does this has a name in the trade, an exploit kit, and it is a rented product, paid for monthly like any software. It carries a little library of known browser and plugin bugs, fingerprints your browser, and picks the one exploit most likely to work on your exact version. No human on the other end at that moment. It is a vending machine.
Now, the reason a modern browser is hard to beat, and it is worth understanding because it is also the reason the old machine is easy. Every serious browser today runs the part that reads web pages inside a low-privilege prisoner process, called a sandbox. That process is stripped of nearly every ability: it cannot touch your files, cannot install anything, cannot talk to the operating system directly. Even if a web page completely takes over that process, the process is in a padded cell.
So a real drive-by needs two exploits, not one, and almost nobody hears this part. First, a renderer exploit: the ad feeds the browser something malformed, usually to the part that runs JavaScript or reads an image or a font, and a memory-corruption bug lets crafted input write where it should not, until the attacker is running their own instructions inside the cell. They own the page process now, but they are still in the cell. Second, a sandbox escape: from inside, the only thing they can talk to is the browser's trusted guard process through a narrow slot, or the operating system kernel through the few commands the cell still allows. A bug in the guard or in a Windows kernel driver lets them step out into full privilege. Two locks, picked in sequence.
That two-lock design is why a fully patched phone is a poor target. The attacker needs a live, unpatched renderer bug and a live, unpatched escape bug, on your exact versions, at the same moment. Chained flaws like that are worth hundreds of thousands to millions of dollars, and they get spent on spies and dissidents, not on a trailer buyer in the Valley.
Here is the other half, and this is the part about small business. Everything above assumes the locks are new. On a stale machine they are not locks, they are decorations. An old browser carries renderer bugs that were published and numbered years ago; the kit does not discover anything, it just tries the old ones. An unpatched Windows has known kernel escapes sitting right there. The two-lock problem collapses to zero locks, because both bugs are public and the patches that would have closed them were never applied. The attacker is not defeating a modern deadbolt. They are walking through a door that came off its hinges in 2022 and was never rehung.
And that is not an accident of size, it is structural, which is why criminals love a small shop. A large company has someone whose job is patching, a system that pushes updates to every machine overnight, and dead browsers like Internet Explorer ripped out entirely. A small business has a ten-year-old PC running the one accounting program that "only works on the old version," a browser nobody updates because updating broke something once, and no one whose job is to notice. The attackers do not fingerprint you and think "small business, skip it." They think "unpatched, easy." The small business is not the target in spite of being small. It is the machine the vending machine actually works on.
Now the arc you actually care about, from the silent click that never happened to the worst day of the year. The first payload is small on purpose and does three things in order. It establishes a foothold: it copies itself somewhere that survives a reboot, a scheduled task or a registry key, so it is still there tomorrow. It phones home: it reaches a server the attacker controls and says "I am alive, here is the business I am on," which is the beacon. And it pulls down the real tooling. That real tooling is the "something worse," and it is usually one of these, often several in sequence.
An infostealer, the fastest money: it scrapes every saved password, plus session cookies, which let the attacker log into your bank or your Microsoft account without your password, because the cookie is the proof you already logged in. This is the Lumma and Vidar family, the ones that at least doubled in the last year. A remote access trojan, a RAT: a live hand on the keyboard, browsing your files and watching your screen at leisure. Lateral movement: with stolen credentials the attacker walks from the one machine to the file server, the other workstations, the backups. And ransomware, the finale: once they have found and deleted your backups, they encrypt every file and leave the note. For a small business that is frequently the end of the business, because the cleanup bill and the downtime land on people who cannot absorb either.
Hold onto one thing from all of that, because it is the hinge of this whole article: the exploit happened inside the browser, where nothing on your network can see it. But every step after the foothold has to cross the wire. The beacon crosses the wire. The tooling download crosses the wire. The reach to the file server crosses the wire. The browser sandbox was the attacker's hard problem. Staying quiet on your network afterward is impossible, and quiet on the network is the one thing they cannot be.
Why your firewall did not see it
This is the part that surprises business owners. The firewall, the antivirus, Windows Defender, the security suite you pay for every year: none of them stopped this, and none of them were supposed to.
They live at the edge of the network and on the hard drive. Malvertising lives inside the browser, inside a page you deliberately opened, delivered over the same encrypted connection as everything else. To the firewall it is a normal visit to a normal website. To the antivirus, no file ever touched the disk. The attack does its tricks at a layer those tools do not look at, and then it is gone.
The day it happened
Now the real one, with the names sanded off.
A phone joined the office Wi-Fi at 11:47 in the morning. A personal phone, a guest, someone waiting on someone. It spent the day on Facebook. At 12:12 PM it followed a Marketplace listing to a used-equipment dealer's website: professional photos, inventory, a phone number, financing terms. It stayed two minutes and change and read about a page and a half of listings.
The dealer did not exist. The website was hosted in an address range that Spamhaus, the internet's oldest reputation authority, had already listed as hijacked criminal space. The listing, the site, the friendly inventory, all of it was built to collect a deposit on a machine nobody would ever deliver.
Here is the part I love, as the statistician in the family. Earlier that same morning, at 7:39, a different phone on the same network touched a throwaway tracking domain and a geolocation lookup service. No click. No scam site. Just the ad doing its quiet arithmetic, deciding what to show. Two flavors of the same campaign, same office, same day, two phones that belonged to two different people, neither of them an employee's work device.
And the address on the network? Both phones, plus a third one in the afternoon, wore the same one. The office router hands out addresses and takes them back quickly, so three people sat on one number in one day. Any tool that watched only the address would have seen a single device behaving strangely. Any tool that watched only company equipment would have seen nothing at all.
The same trick, through Google, on purpose
Marketplace is one door. The other one is the search bar, and it catches careful people, because careful people search.
A few years ago the father in our own family, a farmer of the old school, wanted a trailer. He went to Google, typed exactly what he wanted, and found a dealer in Los Angeles with the right one. The site was good. Plenty of pictures, a small inventory, a Better Business Bureau badge, reviews, an address, a phone number that a real person answered. The price was about $6,000, which is the dangerous number for a trailer: just low enough that a busy man says "I will pay it and be done" instead of building one himself. A little better than the going rate, the kind of price you would expect if the seller had a shop behind them and built these things.
The salesman was warm and in a hurry. Not much stock. This is the last one in that configuration. Another buyer had called about it. If you want it, we need a deposit today to hold it.
He did the one thing the people running that site had not planned for. He said he wanted to drive up and look at it first.
So we looked at it first, from here. The website listed two addresses. On the map, one was an empty lot and the other was somebody's house. Maps go stale, so we checked a second mapping service with a newer capture. Still an empty lot, still a house. No yard, no trailers, no sign, no gate. The reviews were on the site itself, which means they were text somebody typed. The BBB badge was an image, which means it was a picture somebody pasted. Everything about the business was real except the business.
He never drove up. He did not need to. He went out to the shop and built the trailer himself, because that is who he is. Most buyers do not have that option, and the scam is priced so that most buyers never ask to see the lot.
Notice what made it hard. If the trailer had been in another state, "I will drive up and look" stops being possible, and the buyer has to ask a different set of questions. That is where the next section comes in, because the answer is not "never buy from far away." Farmers buy from far away all the time. The answer is knowing which questions a cloned dealership cannot pass.
This is not a rare day
I want to be careful here, because nobody needs another alarmist security article. So let me give you numbers instead of adjectives.
Four days before this post, the Federal Trade Commission published a consumer alert about this exact scheme. Criminals posing as farm equipment businesses advertise tractors at good prices on social media or in search results, send a purchase agreement and invoice, collect thousands of dollars by wire transfer as a deposit, schedule a delivery, and then the delivery never comes. The FTC also names the search-engine version outright: the first results you see may be paid ads, and scammers place those too, pretending to be a real business while using their own contact information. That is the federal government describing, almost word for word, both the page a guest phone opened in a waiting room in our Valley and the trailer site our own family found through Google.
The cases behind that alert are not abstract. In Connecticut this summer, a real dealership called Woodbury Tractor found itself fielding hundreds of calls in under two months from people who had wired money for tractors, skid steers and excavators to an impostor using its street address, many of them after responding to a Facebook ad. One buyer in upstate New York lost $8,500 on a tractor advertised on Facebook and told the Better Business Bureau that all the paperwork had looked legitimate. In Missouri, impostors cloned a small equipment business that has no website at all, ran ads on Facebook Marketplace, and buyers from as far away as California and Arizona reported losing a combined $223,000. A farmer in England lost about £30,000 buying a John Deere from a cloned copy of a French dealership's website; the fake site turned out to be hosted in Panama, and when a friend drove to the real dealership with the invoice, the family there already had a stack of the same fake invoices from other victims.
Zoom out from tractors and the ad channel itself is the story. In the first half of 2025, one in every 78 ads served across tens of thousands of mainstream websites carried risk, whether a scam, malware, or AI-generated deception. Malwarebytes measured a 42 percent jump in malvertising campaigns in the United States over a single year. Microsoft's threat intelligence team documented a 2025 malvertising campaign that compromised close to a million devices worldwide by redirecting people from streaming sites to malware hosted on a platform everyone trusts. And the FBI's own Internet Crime Report puts non-payment and non-delivery scams, the category a fake tractor deposit falls into, at more than $300 million in reported losses in 2023, and those are only the people who filed.
None of those victims did anything reckless. They read an ad on a site they use every day, from a dealer whose paperwork looked right, and sent a deposit the way you would send a deposit to anyone. That is the whole trick. It does not look like crime until the truck does not come.
How we do not get scammed when everything looks right
A good fake passes the eye test. That is its job. So stop testing with your eyes and start testing with things a fake cannot fake. In roughly the order I would do them:
Go and see it. If it is within a day's drive, this one step ends the conversation, one way or the other. A real yard has trailers on it and a person who can walk you to yours.
Map every address they list, on two services. Google Maps, then Apple Maps or Bing, because their photo dates differ. Look at the Street View capture date. An "established 2009" dealer whose address was a vacant lot in a 2024 photo is not a dealer. Two addresses that are a house and an empty lot are the whole answer.
Check the age of the website. Look up the domain at lookup.icann.org or any WHOIS service and read the creation date. Ownership is often private and that is normal; the birthday is not hidden. A business claiming fifteen years with a domain registered four months ago is telling you what it is.
Verify the badges at the source, not on the page. Type bbb.org yourself and search the business name. A BBB seal on a website is a picture; a BBB profile on bbb.org is a record. Same for any "authorized dealer" claim: call the trailer or equipment manufacturer and ask whether that dealer is on their list. Makers keep those lists and answer that question every day.
Find reviews that live somewhere the seller does not control. Google Business Profile, Yelp, the BBB. Testimonials printed on the seller's own site are text somebody typed. Zero off-site history for a business with "hundreds of happy customers" is a verdict.
Reverse-search the photos. Right-click the trailer picture and search by image, or use Google Lens on your phone. Cloned sites steal photos from real inventory, and you will often find the exact same unit, sometimes with a readable dealer sign, sitting on a real lot in a different state at a different price.
Search the company name plus "scam" and plus "complaint," and scroll past the sponsored results. The FTC's advice is exact on this: the first results may be paid ads that scammers bought, so the unpaid results underneath are the ones that tell you what is real. Search the phone number by itself, too; fraud numbers get reused and reported.
Ask for the VIN and the license. Every trailer built for the road has a VIN plate. Ask for a photo of it and run it through the free NICB VINCheck or the NMVTIS lookup. Then ask for their state dealer license number. In California that is a DMV occupational license and you can check it online; a real dealer gives it without a pause.
Ask for a live video walk-around. Not a video file, a call. Have them show you the plate, the tongue, the axles, today's newspaper if you like. A cloned dealership cannot put a camera on a trailer it does not have. This is your drive-up when the lot is in another state.
Watch the pressure, and treat it as a data point. "Last one," "another buyer called," "deposit today to hold it," "price only good this week." A real dealer with a $6,000 trailer does not need to close you in one phone call. Urgency is a tactic, and it is the tactic every one of the FTC's cases shares.
Control the money and the shipping. Never a wire, gift card, cryptocurrency, or payment app to a stranger; those cannot be pulled back. Pay a deposit by credit card, or through an escrow service you chose, and arrange transport through a hauler you found rather than "our delivery truck," which, in every case above, is the truck that never came.
You will not need all eleven. The trailer site in our family failed at step 2 and never got a chance at the rest. Most fakes fail at the first two or three, and the ones that survive that far will fail at the video call. Nobody has yet built a scam that can put a camera on a trailer that does not exist.
How the Blackbox Medusa Intelligence Array saw it
The Blackbox Medusa Intelligence Array does not sit on any device. It sits on the wire, listening to everything the building says to the internet and everything the internet says back. Passive. Nothing to install on a phone, so a phone that walked in five minutes ago is watched exactly as well as the owner's desktop.
Remember the hinge from earlier: the exploit hides inside the browser, but the payload has to phone home and reach out for its tooling, and both of those cross the wire. That is the moment we own. The instant a compromised machine calls its command server or pulls down the next stage, the connection leaves the building and passes the Array, which records it, matches the destination against Spamhaus and a dozen other reputation feeds, and scores the beacon rhythm even when the destination is brand new and on no list at all. On the tiers running Archangel, our real-time alerter, that raises a hand the moment it happens. On every tier, it is traced overnight and laid out on the 6 AM report. The antivirus missed the drop because the drop was invisible; the phone-home is not, and phoning home is the one thing the attacker cannot skip.
That is what happened here, in the milder key of a fraud site rather than a full compromise. The Array caught the reply leg of the dealer visit, the moment the criminal address space answered the phone, and matched the source against Spamhaus's list. That raised a high alert. Then the work started, because an alert is a question, not an answer.
We pulled the connection: 141 seconds, a few kilobytes up, about two megabytes down. Reading, not downloading. The file log showed nothing fetched. The DNS log gave us the exact second the phone asked for the dealer's name, which put the click at 12:12:42 PM. The DHCP fingerprint, the particular way a device asks for an address, told us it was a recent-model iPhone and not the employee's computer that our records had at that number, and it separated the three phones that shared the address into three different people. The morning tracker hit, on a different fingerprint, told us the campaign had been sizing the room since breakfast.
Verdict: a fraud warning, not a compromise. Nothing was installed, no credentials moved on the wire. But had that same phone met the drive-by version instead of the deposit scam, the payload's very first call home would have crossed the same wire, in front of the same Array, and the story on the 6 AM report would have read the same way: caught, traced, named. The customer was told the same morning: this dealer is not real, warn your people, send no deposits. We also recommended two things that cost almost nothing, a separate guest Wi-Fi so visitors' phones never share an address pool with the office, and longer leases so a device keeps its number long enough to be known.
Nobody would have known otherwise. Not the guest, who left with a bookmark and a price in mind. Not the business, whose antivirus reported a perfect day.
What you can do with your own devices
On workstations, install two browser extensions: uBlock Origin and AdGuard. Together they block the ad delivery channel itself, which means the code never loads, which means there is nothing to fingerprint you, redirect you, or probe you. They also hide the sponsored results at the top of a Google search, which is where the cloned dealers buy their way in. At one of our sites, tracking beacons went from three a day to zero in three days after those two went in. Most people outside this business have never heard that they need them. Ahora ya lo sabes.
Then, the browser itself, because the brand matters less than the patch. A fully updated Chrome, Edge, Firefox, Brave, or Safari is a hard target with a strong sandbox and a fast patch cadence. The same browser a year stale is a soft one, and the best browser in the world on a machine nobody updates is the worst browser in the world. For a set-and-forget business machine I lean toward Firefox, which accepts a locked policy an update or a curious user cannot undo, or Brave, which blocks the ad channel by default so a non-technical user is protected without installing a thing. What to retire today: Internet Explorer and anything hiding an "IE mode," plus any off-brand or abandoned browser with no one behind it shipping fixes. If a workflow "needs Internet Explorer," that is not a preference, that is the open door in this article.
Phones are harder, and this is where the real gap sits for most people. Extensions do not exist on a phone browser the way they do on a desktop. What works: on iPhone, a Safari content blocker such as AdGuard; on Android, Private DNS pointed at a blocking resolver; on either, a DNS service like NextDNS that filters at the network level. And keep the operating system updated, always, because the drive-by version needs an old phone.
For a business, protect the room instead of the device. Put ad blocking on the guest Wi-Fi at the router, where every visitor's phone benefits without installing a thing. That is the same win, delivered to people you will never meet.
And if you are the one sitting in the waiting room with a coffee, or at the kitchen table with a search bar: a dealer you have never heard of, priced a little too well, in a hurry, asking for a wire before you see the machine, is not a deal. Cierra la página. Call someone who has actually bought from them, or go build the trailer.
Why we tell you this
Because the tools everyone already owns were built for a different attack. They watch the door and the hard drive. Malvertising walks in through the page you opened on purpose and leaves without touching either.
Somebody has to watch the wire. That is what the Blackbox Medusa Intelligence Array is for. It did not care that the phone was a guest's, or that three people shared one address, or that the antivirus had nothing to say. It heard the building talk, it recognized who was on the other end, and at 6 AM the next morning it put the whole story on one page.
Claudia @ SmiteByte