Ransomware groups are purchasing Bing ads to target enterprise users, expanding malvertising into search infrastructure embedded in corporate environments.
Malvertising defenses have historically centered on Google, which handles over 90% of global search traffic. The logic was straightforward: more users meant more potential victims, which meant more attacker interest.
Enterprise environments tell a different story. Microsoft has spent years weaving Bing into corporate computing. Edge ships as the default browser on Windows devices, Copilot draws on Bing for real-time information, and the Windows search bar routes queries through Microsoft’s infrastructure. In organizations standardized on Microsoft 365, employees interact with Bing far more than global market share would suggest. Many don’t realize they’re using it at all.
Attackers have found this gap valuable. Malwarebytes reported a 42% increase in malvertising incidents in 2024, with campaigns increasingly targeting Bing search results and Bing Chat responses. Ransomware groups that once focused exclusively on Google have begun purchasing Bing advertisements to reach enterprise users through a less-monitored channel. The campaigns reveal how attackers weigh enterprise value against detection likelihood, and why organizations with significant Microsoft footprints may need to reconsider their monitoring priorities.
Why Bing attracts enterprise-focused attackers
Microsoft Edge holds approximately 13% of global browser market share, ranking third behind Chrome and Safari. In corporate environments where IT departments standardize on Windows and Microsoft 365, that share runs considerably higher. These users encounter Bing through default settings, integrated features, and AI assistants that surface Bing-powered results without announcing their source.
The integration creates a trust dynamic that attackers have learned to exploit. When a sponsored result appears in the Windows search bar or alongside a Copilot response, it carries the implicit endorsement of the Microsoft ecosystem. Users who might scrutinize an unfamiliar website often extend that trust to results served through familiar infrastructure.
The Rhysida ransomware group has built campaigns specifically around this dynamic. Since 2024, the group has purchased Bing advertisements that appear when employees search for Microsoft Teams, directing them to convincing download pages that install OysterLoader malware. Rhysida has claimed approximately 200 victims since 2023, including the British Library and Seattle-Tacoma International Airport. Microsoft has revoked more than 200 code-signing certificates used in the campaign, though the group has repeatedly resumed operations after brief pauses.
Other threat actors have adopted similar approaches. Security researchers have documented weaponized versions of PuTTY distributed through Bing ads, targeting system administrators whose devices often hold privileged access to Active Directory environments. The DFIR Report traced a Bumblebee-to-Akira ransomware infection chain that began with Bing SEO poisoning rather than traditional phishing.
Malvertising inside AI conversations
The emergence of AI-powered search has created new surfaces for malvertising that operate differently than traditional search results.
When Microsoft began inserting advertisements into Bing Chat in March 2023, it introduced a context where users interact with sponsored content differently than they would on a search results page. In traditional search, users see multiple results and evaluate them against each other. In a conversational interface, responses feel more singular and authoritative. The ad label exists, but it’s subtle enough to miss in the flow of an exchange.
Malwarebytes documented campaigns where malicious advertisements appeared when users hovered over links in Bing Chat responses. The campaigns targeted system administrators searching for network tools and lawyers searching for case management software: professionals whose devices often hold privileged access to corporate systems, and who might reasonably expect an AI assistant to surface legitimate results.
Research suggests users extend more credibility to conversational AI responses than to traditional search result pages, treating chatbot recommendations more like advice from a knowledgeable colleague than a list of options requiring independent verification. For attackers, this represents an opportunity to reach users in a context where their usual skepticism may be lower.
Why Bing malvertising matters for enterprise security
The pattern emerging across these incidents points to a broader shift in attacker targeting.
Traffic volume has traditionally guided where security teams focus brand impersonation monitoring for search advertising. Google’s dominance made it the obvious priority. But attackers weigh multiple variables: not just traffic volume, but also detection likelihood, enforcement response times, and the value of reachable targets. A platform with lower overall traffic but higher concentrations of enterprise users can offer attractive returns.
The Rhysida campaign illustrates this calculus. By purchasing Bing ads for Microsoft Teams, the group reached users who are, by definition, enterprise employees working in Microsoft-standardized environments. These are exactly the targets most valuable for ransomware deployment: professionals with access to corporate networks, often working on devices connected to production systems.
The campaign’s longevity is notable. Despite multiple takedowns and certificate revocations, Rhysida has repeatedly reconstituted its Bing malvertising operations. The persistence suggests the returns justify the effort, and that the group views Bing as a productive channel worth defending.
For organizations with significant Microsoft footprints, Bing malvertising represents an emerging category of risk rather than a theoretical concern. The attackers exploiting this channel are sophisticated, persistent, and specifically targeting enterprise users.
The Bottom Line
Global search market share provides an incomplete picture of enterprise threat exposure. Employees in Microsoft-standardized environments encounter Bing through channels that don’t register as search at all: the Edge address bar, Windows search, Copilot responses. Each of these surfaces can serve advertisements, and each has now been exploited by attackers distributing malware.
The ransomware groups and threat actors targeting Bing have made a deliberate choice. They’re pursuing enterprise users through infrastructure those users trust implicitly, in a channel that has historically received less security attention than Google. Organizations extending their malvertising monitoring to include Bing are adapting to where attackers have already moved.
Key Takeaways
Enterprise environments standardized on Microsoft products route significant search traffic through Bing via Edge defaults, Windows search integration, and Copilot. These users represent high-value targets for ransomware deployment. Groups like Rhysida have found this channel productive enough to repeatedly rebuild campaigns after takedowns.
Rhysida has purchased Bing advertisements for fake Microsoft Teams download pages since 2024, distributing OysterLoader malware to enterprise users. The group has claimed approximately 200 victims since 2023, including the British Library and Seattle-Tacoma International Airport. Microsoft has revoked more than 200 code-signing certificates associated with the campaign.
Conversational AI interfaces present responses as authoritative rather than as a list of options to evaluate. Users tend to extend more trust to chatbot recommendations, and ad labels in chat contexts are less prominent than in traditional search results. Attackers have exploited this dynamic to reach high-value professionals like system administrators and lawyers.
Beyond Rhysida’s Microsoft Teams campaign, security researchers have documented weaponized PuTTY distributed through Bing ads targeting system administrators, and a Bumblebee-to-Akira ransomware infection chain that began with Bing SEO poisoning.
Attackers purchase Bing advertisements that appear when employees search for common enterprise tools like Microsoft Teams or PuTTY. The ads direct users to convincing download pages that install malware. Because Bing is deeply integrated into Microsoft enterprise products, users often encounter these ads through trusted interfaces like the Windows search bar or Copilot.
