Seasonal planning depends on expectations: when advertising demand will rise, when audiences will spend more time online, and when malicious activity is likely to intensify. The Media Trust’s latest scareware (aka StringRipper) attack findings suggest the industry should reconsider the timing of that last assumption.
Unique outbreaks increased 681% from August to September, reaching their highest monthly level of 2026 so far. The acceleration came at the end of a quarter that, in TMT’s experience, is often quieter as bad actors prepare for Q4 and the holiday season.
The significance extends beyond the percentage. A major phishing threat gained substantial momentum before the period when the industry typically expects heightened pressure. For publishers, app developers, and advertising platforms, that changes the starting point for holiday-season preparedness.
An early surge changes the planning conversation
The September increase followed relatively low activity in July and August. Although the low August baseline contributes to the size of the percentage change, September also exceeded the previous 2026 monthly peak.
Scareware activity rose 363% year over year in September, reaching more than four times its September 2025 level
The year-over-year comparison puts this early acceleration in context. The charts above cover August–December 2025 and June–September 2026, with August and September providing the direct comparison: both months recorded more StringRipper activity in 2026 than in 2025.
Last year, activity surged from October through December, establishing a clear holiday-season pattern. This year’s higher late-summer activity suggests the industry is entering Q4 from a more elevated starting point. A similar seasonal escalation would compound that pressure on audiences, advertising revenue, and operations.
TMT expects continued StringRipper scareware activity through October and Q4. The industry should prepare for the holiday season with a threat that has already gained significant momentum.
The delivery has evolved beyond the familiar warning
People may recognize the visible elements of a tech-support scam: an alarming popup, an apparent security alert, or an urgent instruction to fix a device. StringRipper’s delivery has become considerably more sophisticated.
TMT’s research has documented how the threat compromises ad tags associated with legitimate campaigns. Ordinary-looking creative can conceal malicious behavior, while environmental checks and varying activation timing help the attack evade detection.
A campaign that appears harmless during review may behave differently when it reaches a targeted visitor. The resulting redirect can pull someone away from their chosen content and into a phishing experience.
That gap between appearance and behavior is central to the challenge. Assessing the creative alone cannot establish what an ad will do throughout its delivery.
The audience pattern deserves equal attention
TMT’s findings identify senior citizens as this threat vector’s leading target. In September’s separate age-group breakdown, approximately 70% of recorded outbreaks were associated with seniors.
That percentage describes the age-group dataset, rather than all outbreaks or the number of people who fell victim. It nevertheless provides an important perspective on the threat: aggregate volume tells only part of the story.
Understanding which audiences encounter malicious behavior helps businesses assess the consequences of an outbreak. A fraudulent warning delivered during a visit to a familiar website can exploit the confidence a person places in that environment.
For publishers and app developers, audience protection is closely connected to the quality and credibility of their own experience.
Redirects create commercial and operational exposure
Recent industry conversations have reinforced publishers’ and app developers’ frustration with unwanted redirects. They interrupt sessions, take people away from content, and can reduce opportunities for engagement and monetization.
They also create operational work. Teams must investigate complaints, reproduce selectively triggered behavior, identify the source, and coordinate with advertising partners.
Users rarely see those supply-chain relationships. They remember the website or app they were using when the problem occurred. Legitimate advertisers face reputational exposure too, when their campaigns become vehicles for malicious activity.
These consequences make redirect prevention a business priority across revenue, operations, and audience experience.
Q4 readiness requires continuous visibility
September’s findings support a broader planning principle: protection should respond to observed behavior, with seasonal expectations providing context.
Businesses need visibility into live advertising experiences, the ability to interrupt malicious redirects, and clear processes for acting with upstream partners. TMT combines ongoing threat analysis with detection and real-time protection designed to address harmful behavior before it disrupts the user experience.
The precise scale of Q4 activity remains to be seen. The early warning is already measurable. A 681% monthly increase before the holiday season gives the industry a clear reason to reassess its readiness now.
________
About Chris Olson
Chris Olson is the CEO of The Media Trust, where he has spent more than two decades protecting brands, publishers, and consumers from digital threats across advertising, content, and data ecosystems. He is also the founder of Proxyware, a proactive digital protection platform designed to safeguard vulnerable populations by stopping harmful online threats before they reach the end users. Olson is widely recognized for his expertise in digital risk, consumer safety, and the evolving tactics of online fraud and exploitation, with a focus on prevention over reaction.
Join our LinkedIn group Information Security Community!
