A few reports coming in over the past day describe occurances where Spotify's free streaming service on desktop computers is pushing malware-filled advertisements to users without their input.
According to a user posting on Spotify Community, the malware causes ads to launch "and keep on launching" the computer's default browser to different sites lined with viruses (via The Next Web). Multiple macOS and Safari users have confirmed the issue to be happening on Apple systems.
There's something pretty alarming going on right now with Spotify Free. This started a several hours ago. If you have Spotify Free open, it will launch - and keep on launching - the default internet browser on the computer to different kinds of malware / virus sites. Some of them do not even require user action to be able to cause harm.
I have 3 different systems (computers) which are all clean and they are all doing this, all via Spotify - I am thinking it's the Ads in Spotify Free. I hope this has been noticed and Spotify staff are fixing it - fast. But it's still puzzling something like this can actually happen.
It's not clear yet what's causing the issue, but multiple confirmations of its connection with Spotify Free have surfaced on Twitter, with users reporting that malware ads have appeared on both Mac and Windows platforms. Spotify has responded to a few users on Twitter and appears to be looking into the issue, but has yet to make an official announcement.
One Mac user was running OS X El Capitan 10.11.6 on a mid-2014 MacBook Pro when the ads in Safari began popping up.
PSA: uninstall Spotify free, their ads are plagued with malware right now. pic.twitter.com/DUOqDrnDUZ — Volp (@VolpRS) October 5, 2016
Spotify eventually commented on the problem, saying "we sincerely apologize to any users affected. We'll continue working hard to ensure this does not happen again and that our users enjoy Spotify securely and in confidence."
Top Rated Comments
Spotify needs to reconsider which kind of ads they allow. Obviously they can't allow anything involving scripts!? The app has to only support static JPEG's, and the JPEG's need to be verified to actually be JPEG's for that matter. If they are blindly trusting ad providers, they are doing it very wrong.
Not saying Spotify isn't partially to blame. They chose the advertising partners to work with, and obviously those partners do a piss poor job of vetting ads. Still, this should be a moment to point the pitchforks at the advertising industry as a whole, rather than just Spotify.