Systems, methods, and computer-readable media are disclosed for detecting anomalous advertising content and taking or directing one or more actions to be taken to mitigate risk associated with anomalous advertising content. The anomalous advertising content indicates a deviation from an expected state of the advertising content. Various measures may be taken to determine whether the anomalous advertising content is reflective of malware.