Google Deploys Gemini AI to Combat Malvertising and Brand Fraud

Google has disclosed a strategic shift in its defensive capabilities, according to Bleeping Computer, by increasingly integrating Gemini Large Language Models (LLMs) to enhance its ad safety ecosystem. This initiative aims to counter the rising volume of sophisticated Phishing and scam campaigns that utilize generative AI to produce deceptive content at scale. In its 2023 Ads Safety Report, Google highlighted the removal of over 5.5 billion ads and the suspension of 12.7 million advertiser accounts, illustrating the massive scale of the threat.

The Shift from Traditional ML to LLMs

Historically, ad platforms relied on traditional machine learning models to identify violations of service. While these models excel at pattern recognition, they often lack the contextual reasoning required to identify nuanced TTPs, such as subtle brand impersonation or sophisticated cloaking. Cloaking involves presenting benign content to automated reviewers while serving malicious payloads to actual users. The deployment of Gemini allows Google’s safety teams to analyze advertising content with a level of reasoning that approaches human capability, facilitating the identification of deceptive intent rather than just matching known IoC signatures.

How to detect malicious ads using Gemini AI

The application of Gemini AI for ad safety provides a more holistic view of the advertiser’s journey. Instead of analyzing an ad in isolation, the LLM can evaluate the semantic relationship between the ad copy, the visual elements, and the final landing page. This is particularly effective against “limited ad serving” accounts—new advertisers without a established reputation who may be attempting to distribute Ransomware or establish a C2 channel.

By leveraging the reasoning capabilities of Gemini, Google can identify when an advertiser is attempting to spoof a legitimate brand by using near-identical imagery or confusingly similar domain names. The LLM can interpret the nuance of the landing page’s request for information, distinguishing between a legitimate sign-up form and a credential harvesting operation designed for Privilege Escalation within an enterprise network.

Mitigate malvertising threats in enterprise environments

Despite these platform-level advancements, security professionals must recognize that no automated system is infallible. Malvertising remains a potent initial access vector for attackers seeking Lateral Movement within high-value targets. Organizations should implement a Zero Trust security model to ensure that even if a user is redirected to a malicious site via a compromised ad, the impact is contained.

Deploying advanced EDR solutions and maintaining a vigilant SOC are essential components of a defense-in-depth strategy. Analysts should configure their SIEM to alert on outbound connections to newly registered domains (NRDs) or suspicious top-level domains that often host malvertising landing pages. Combining platform-level AI protections with local security controls creates a multi-layered defense against evolving ad-based threats.

Actionable Recommendations

• DNS Filtering: Implement DNS-layer security to block traffic to known malicious domains and categorized “Adware” sites.
• Browser Policies: Enforce enterprise policies that disable high-risk browser features and restrict the installation of unauthorized extensions.
• User Training: Conduct regular security awareness sessions focusing on the identification of sponsored search results that may impersonate legitimate software vendors.