Skip to main content

If you're a free Spotify user, then you might've been exposed to malware

Spotify Premium
Image used with permission by copyright holder
The adage “you get what you pay for” has taken on new meaning lately, with free services and apps that rely on advertising often providing a little something extra to users. Service providers and developers can’t always control what’s injected in their ad streams, and as Spotify recently discovered, some malware might very well go along for the ride.

No matter which platform you use, if you’re a Spotify listener who’s opted for the free version rather than shelling out for a monthly subscription, then you might have been exposed to some malware due to a recent incident. Spotify moved quickly to fix things up, according to Engadget, but whether you’re listening on a Mac, a Windows machine, or a Linux box, there’s a chance that you might have seen an infected ad or two pop up.

Spotify admitted the problem in a statement to Engadget, while downplaying the number of affected users affected and promising to keep an eye on things. “A small number of users have experienced a problem with questionable website pop ups in their default browsers as a result of an isolated issue with an ad on our free tier,” Spotify said. “We have now identified the source of the problem and have shut it down. We will continue to monitor the situation.”

This isn’t the first time that Spotify served up malicious content in its advertising, with a similar incident occurring in 2011. Spotify isn’t alone, as any number of other providers have also been subjected to the spread of malware through advertising, otherwise known as “malvertising.”

The bottom line is this — if you use a free service that’s funded by advertising, then you run the risk of exposure. The safest bet is to make sure that your devices are protected by some kind of antivirus and anti-malware software. You can learn more about some good options in our recent free antivirus roundup, and if you want to avoid ad-based malware in at least one service, then you can always sign up for a paid Spotify subscription at $9.99 a month.

Mark Coppock
Mark has been a geek since MS-DOS gave way to Windows and the PalmPilot was a thing. He’s translated his love for…
A dangerous new jailbreak for AI chatbots was just discovered
the side of a Microsoft building

Microsoft has released more details about a troubling new generative AI jailbreak technique it has discovered, called "Skeleton Key." Using this prompt injection method, malicious users can effectively bypass a chatbot's safety guardrails, the security features that keeps ChatGPT from going full Taye.

Skeleton Key is an example of a prompt injection or prompt engineering attack. It's a multi-turn strategy designed to essentially convince an AI model to ignore its ingrained safety guardrails, "[causing] the system to violate its operators’ policies, make decisions unduly influenced by a user, or execute malicious instructions," Mark Russinovich, CTO of Microsoft Azure, wrote in the announcement.

Read more