https://preview.redd.it/h2y10ginctkh1.png?width=1080&format=png&auto=webp&s=fd427f9fad2c4be6c1c1ec981e9e317ed244ae98
https://preview.redd.it/9vu21ginctkh1.png?width=1080&format=png&auto=webp&s=04ba74f4f8cbe7c18635d8308de54c2342310404
These are screenshots of the android YouTube app on GrapheneOS (I've covered over anything identifying the channel). The person who's phone this is thought their phone had been hacked and that's why they're seeing these messages. What they said to me was "I'm getting messages on my phone that my photos are not safe and I need to ..." What had actually happened is they had "accidently" installed the native YT app and prior to August 2026 they never had to see malvertising like this because FF for Android has uBO in it and aggressively blocks this stuff.
What I want to point out is the fine details of the malicious ad:
The ad reads "Warning. You are currently using an older version of the PDF reader. If you do not update, you may lose your data." and has what appears to be a button on it that says "Update". It is designed to look like a system message.
The user had already clicked on "Skip Ad" at the start of the video, and thus it had not registered with them that this was in fact another ad but not a video ad. Remember the context: they usually have a clean experience of YT thanks to adblocking, it was not intuitive that after clicking on "Skip Ad" another non-video ad would pop up.
The malicious ad abuses its position in the viewport. This is made possible because of the design of the Android app; as mentioned this phone is running GOS hence it's a Pixel series phone with a standard sized screen, YT are the ones in control of the viewport.
As above, the ad itself is not labelled as an ad until you scroll down; and that's not intuitive to a new user to the app. There's no visible scrollbar and no indication that anything about the ad continues further down, and the word "Sponsored" is not visible until you scroll down.
The app itself is obviously a malicious app, and herein completes the circle. YouTube is advertising it, Google is publishing it on their Play Store and ordinary users put far more trust into the Play Store.
These malicious ads had been appearing regularly.
A malicious ad does not need to be particularly sophisticated to trick the user.
The point of this post is to clearly demonstrate to the people who say "we need advertising to pay for ..." that the advertising we have is malicious and there is no way for anyone other than the ad publishing networks to fix it. The YT channel owner can't make sure ads like this are correctly labelled, they can't reposition them in the viewport, and they can't review malicious ads like this that get shown to their viewers prior to them being shown.
No comments:
Post a Comment