Malvertising Trends: Weekend vs. Weekday Attack Patterns

by Marshall Moritz, on Sep 23, 2020 9:51:04 AM

One of the most common questions we are asked about the data we collect on malvertising attacks across our network is: “when do attacks happen?”

Everyone wants intel on when to expect attacks so they can be more prepared.

Specifically, a common question is whether attacks are happening more on weekdays or weekends given that staffing and traffic levels can vary greatly between the two time frames.

We went straight to the data to find out what malvertising attack trends look like by day of the week.

-- Article Continues Below --

New call-to-action

Visit the Complete Malvertising Resource Center

Weekday vs. Weekend Attack Trends

So let’s get right to it: when do more attacks happen?

As you might guess, the answer is “it depends.”

In this case, it depends on the device on which the ads are displayed. Over the last few months, our data has shown that threat and attack levels are higher on weekdays than weekends for mobile devices. And the opposite is true for desktop: weekends have higher attack levels than weekdays.

When we sat down to look at this data, I have to admit we were a little surprised at first.

One might initially think that it should be reversed. Based on user behavior, we’d expect people to spend more time on desktop devices during the week when they are working; the balance would then shift to higher mobile usage on weekends. Malvertising would therefore be more likely to occur when more users are present on devices. 

Take a look at what we are seeing in terms of threat level by day of the week on mobile vs. desktop in the graphic below.


Digging in deeper, it is actually not that surprising that we see this behavior.

Malvertising attacks tend to follow one of two trends pretty closely:

  1. Usage patterns: Malvertisers want to be where the most users are to maximize the potential views.
  2. Demand and advertising prices: Malvertisers want to get the greatest ROI so they run campaigns when CPMs are lowest.

Often, attack timing ends up being decided by the results of small probing attacks. Bad actors will run small-scale attacks, see which ones generate the highest ROI, and then put all their efforts behind those winners.

In this case, the data indicates that bad actors are likely targeting lower advertising prices rather than higher user volume.

This prompted us to take a look at ad cost trends and usage statistics for all devices on both weekdays and weekends.

Read the Case Study

How cleanAD Completely Eliminated Malicious Redirects, Freeing up 60 Hours of AdOps Efforts per Week, for Venatus Media

Read the Case Study

Ad Cost Trends

Advertising Agency Acquisio finds something similar to what we expected in that across most “business” industries, advertising during the week, “is more advantageous, with more people searching, viewing and clicking on ads,” than on weekends. 

Mondays in general have been noted as the most popular buying time for ecommerce sites, and thus in many cases generate the highest return on advertising spend. Acquisio also notes that advertising cost is the lowest during times when demand is the lowest, with ad prices generally being considerably lower on weekends.

Mobile advertising costs, by contrast, are a little different. Liftoff often sees cases where CPMs stay relatively stable throughout the week and then spike on the weekends. This supports our data, which shows a higher attack frequency during the week for mobile devices.

Usage Statistics

Looking more deeply at usage statistics from by day of the week for both mobile devices and desktops, we can see that, in general, mobile devices are used more heavily than desktop devices across the board.

And we do see a clear jump in mobile usage on weekends, as expected.



This is backed up clearly by apptamin which found that there is a huge surge in daily active mobile users on weekends vs. weekdays.



Ability to Scale Attacks

One other factor to note is the ability for malvertisers to scale attacks.

Weekends are traditionally “time off” for many professionals, including ad operations teams.

This means that it may take them longer, since they are not at their desks actively monitoring, to recognize and stop attacks before they can scale.

In this environment, malvertisers may be able to take the extra time to scale an attack to a much larger level than what they could on a weekday when their actions are being monitored more closely.

In general, work schedules for publishers have their staff working weekdays and off on weekends. This audience, for this particular group, is where desktop usage will be highest.

By contrast, many firms that run mobile apps often employ more of a “shift” schedule in which someone is always on call. This potentially makes it easier for scaling weekend attacks on the more heavily desktop-focused publishers, lending to the trends we see.

Read the Guide

Malvertising: What You Need to Know to Prevent It

Malvertising prevention is essential for any publisher with an expansive online presence, and shoring up your lines of defense is a worthwhile investment.

Read the Guide

How All of This Relates to Attack Trends

What all of these factors come together to show us is that malvertisers are anything but predictable, and there are quite a few factors that weigh into when and how they choose to attack.

As mentioned above, typically what we see in our data is that malvertisers will run small, probing attacks to find the highest ROI and then work to scale those attacks that are producing the greatest return.

What that looks like today is targeting desktop devices on weekends to take advantage of lower advertising prices and slower attack response times.

On mobile, the attacks that are producing better ROI are happening on weekdays (again when advertising costs are lower). And in the case of mobile, attack response times may be relatively stable despite the day of the week.

Final Thoughts

The way in which malvertisers attack can and will shift over time. Just because we see these attack patterns today, doesn’t mean they will stay the same tomorrow. Because bad actors are triggering larger scale attacks off the success of small probing attacks, they are just following the path that the data tells them is most efficient in a given time. 

If something small about the landscape changes, making attacks more profitable at different times, they’ll see it and shift.

For you, this means that being protected all the time is incredibly important.

Try cleanAD free for 14-days to see why major publishers trust our platform as the simplest, smartest, and most effective anti-malvertising solution available.

The Complete Guide to Malvertising

Topics:Malvertising DataMalvertising

Our blog

Where businesses come to learn more about protecting the points of digital engagement with their customers, audiences and users.

Subscribe to Updates