Adware is software that displays, injects or otherwise delivers advertising to a user, often as part of a free application or service. Advertising itself is not inherently malicious, and legitimate ad-supported software can be transparent about its behaviour and provide value in exchange for displaying advertisements. The term becomes associated with security concerns when advertising software is deceptive, excessively intrusive, difficult to remove, bundled without meaningful disclosure, changes browser settings, redirects traffic, tracks users improperly or delivers malicious advertising. Security discussions therefore often distinguish ordinary advertising-supported software from potentially unwanted or malicious adware based on consent, transparency, behaviour and impact.
Traditional desktop adware could display banners, pop-ups or advertisements within applications, while browser-oriented adware could inject advertisements into webpages or alter search results and browser settings. Some variants install browser extensions or background components that monitor browsing activity to select advertisements. Others may change the default search engine, homepage or proxy configuration. Modern advertising ecosystems are substantially more complex because advertisements can be delivered through web pages, applications, mobile operating systems and third-party advertising networks. Consequently, the presence of advertising does not necessarily indicate adware, and identifying the software component responsible for unwanted advertising may require examining browser extensions, installed applications, network requests and configuration changes.
Adware commonly reaches users through software bundling, freeware downloads, deceptive installers, malicious advertisements, compromised websites or unwanted browser extensions. Bundled software may be presented during installation through optional offers that users overlook, although deceptive bundling can make meaningful choice difficult. Malvertising is related but distinct: it refers to malicious activity conducted through advertising channels, such as advertisements that redirect users to malicious sites or exploit vulnerabilities. An advertisement-delivering application can therefore be adware without being responsible for malvertising, while a legitimate advertising platform can be abused by malicious advertisers without the platform itself being adware.
The security significance of Adware varies considerably. Benign advertising-supported software may have little security impact beyond displaying advertisements, while aggressive variants can degrade performance, alter browser behaviour, collect browsing information or expose users to additional malicious content. Some adware can create persistence mechanisms that cause advertisements or redirects to return after apparent removal. Unwanted changes to browser configuration can also increase exposure to phishing or fraudulent websites. The distinction between nuisance, potentially unwanted software and clearly malicious software is therefore often based on behaviour, user expectations, consent and the degree of interference rather than on the simple presence of advertising.
Detection of Adware can involve monitoring unexpected browser changes, unfamiliar extensions, unusual processes, injected webpage content, repeated redirects and suspicious network connections. Endpoint security products may classify some adware as potentially unwanted applications rather than traditional malware. Browser security mechanisms can prevent certain extensions or websites from performing unsafe actions, while managed environments can restrict software installation. Users can reduce exposure by obtaining applications from reputable sources, reviewing installation options and avoiding unofficial software repositories. Removing unwanted components may require uninstalling applications, deleting browser extensions and restoring altered browser settings.
Adware is frequently confused with spyware because some ad-supported software also collects information about users. The terms describe different primary characteristics. Adware concerns advertising delivery or monetisation behaviour, whereas spyware concerns covert or unauthorised surveillance and information collection. They can overlap when an advertising program tracks browsing activity extensively or when spyware displays advertisements as part of its operation. Adware is also distinct from a computer virus because it does not require self-replication, and it is distinct from ransomware because its principal function is not extortion through denial of access.
Advertising technologies have legitimate economic uses because they allow developers and publishers to offer content or software without direct payment. However, the collection of behavioural data, use of persistent identifiers and delivery of targeted advertising raise privacy and security considerations. Browser and mobile-platform controls have increasingly restricted certain tracking techniques, while privacy regulation in various jurisdictions establishes requirements concerning personal data processing and consent. These developments have affected how advertising-supported software operates. The security analysis of Adware must therefore account for both technical behaviour and the legal or policy context governing data collection and advertising practices.
A common misconception is that every pop-up or unwanted advertisement proves that a device contains Adware. Websites themselves can display advertisements, and malicious websites can produce redirects without installing persistent software. Conversely, adware can operate through browser extensions or background processes without obvious standalone pop-ups. Troubleshooting should therefore determine whether the behaviour occurs only on particular websites, whether it persists across browsers, whether browser configuration has changed and whether unfamiliar software or extensions are installed. This distinction prevents legitimate advertising, website-level malvertising and locally installed adware from being incorrectly treated as the same technical problem.
