The researchers point out, “Neither scam relied on exploiting a software vulnerability.” 

Rather, these scams deceived users into intentionally taking the next step. As the research indicates, security software cannot entirely prevent these types of threats, as browsers struggle to discern between legitimate browser messages and those rendered in a webpage’s HTML. Furthermore, antivirus is not capable of entirely defending against these threats either, as the scam executables use misleading icons and unconventional metadata, which are also present in legitimate applications.  

When malvertising leverages a popular topic — such as the recent release of The Odyssey — the scam doesn’t require sophistication. All it needs is search traffic from victims interested enough to forgo caution.