Malware & deception
Malware in creative or landing page
- Ad Manager API value
- MALWARE_IN_CREATIVE
What Google's rule says
The Ad Manager API carries two separate values here: MALWARE_IN_CREATIVE, malware was found in the creative, and MALWARE_IN_LANDING_PAGE, malware was found in the landing page. Authorized Buyers reports the same finding as malicious or unwanted software.
What actually causes it
- A compromised ad server, CDN or asset host injecting code into an otherwise clean creative.
- A landing page compromised at the site level, with the creative entirely innocent.
- A third-party library in the creative pulled from a hijacked package or host.
- A malicious payload delivered only under specific geo, device or timing conditions.
How to fix it
Read which of the two values was returned before doing anything else. The creative value points at your tag chain and its asset hosts; the landing page value points at the destination site, where Google Search Console will show the finding and where the site owner has to do the work.
The part that is not obvious
Two enum values for what looks like one problem is the single most useful thing the API gives you here, because they send you to different teams and different systems. It also matters that this is the reason most likely to be conditional: malicious payloads are commonly served only to a slice of traffic, so the creative will look clean every time you load it and be entirely guilty at the same moment. "I cannot reproduce it" is the expected result, not evidence of a false positive.
Related reasons
Reason name and API value verified against Ad Manager API — CreativePolicyViolation (v202602) on 30 July 2026 (Ad Manager SOAP API v202602). The causes and fix above are practitioner guidance, not Google policy text.