#FINANCIAL_LITERACY

During the hearing, lawmakers cited recent examples of malicious ads reaching consumers. Spiezle said many large companies have faced malvertising attacks.

"In February of this year, an engineer at a security firm discovered that advertisements on YouTube served by Google's ad network delivered malware to visitor's computers. … That virus was designed to break into consumers' bank accounts and transfer funds to cybercriminals," said Sen. John McCain, R-Ariz.

YouTube is owned by Google. And in a statement sent by e-mail, a Google spokesman said, "In February, we detected ads on YouTube that violated our advertising policies. We have zero tolerance for these incidents and our teams quickly took the appropriate actions to resolve this issue."

And according to Google's blog, Google removed 350 million bad ads in 2013, including disabling ads from more than 400,000 websites that were hiding malware.

In written testimony, Yahoo said it "has built a highly sophisticated ad quality pipeline to weed out advertising that does not meet our content, privacy or security standards."

Read MoreLessons from Target's data breach fumble

According to lawmakers, many of the malvertising attacks can be traced to international cybercriminals, including those in Russia.

"When law enforcement raided the hideout of a Russian cybercriminal network, they found calendars marked extensively with U.S. federal holidays and three-day weekends," McCain said. "These cybercriminals were not planning Fourth of July picnics, of course, they were planning to initiate malware attacks when security staffing at the ad networks would be at their lowest."

Last holiday season, cybercriminals were able to put malicious ads on Yahoo. McCain said the ads were designed to seize user's computers to mine for the digital currency bitcoin, which requires large amounts of computer power.

"In just one day, in just one hour, 300,000 users were exposed to a malicious ad of which 9 percent or 27,000 users were compromised," Spiezle said about the Yahoo incident.

In a statement e-mailed to CNBC, a Yahoo spokeswoman said the ad targeted I.P. addresses in the European Union. "Since then we have expanded our testing program to include greater geographic and technological diversity and mitigate this kind of spoofing," she said.

Read MoreHacker starts hedge fund targeting vulnerable companies

One reason for malvertisements is that Web ad networks have gotten more complex. A single ad can go through as many as six intermediaries before reaching websites it appears on, according to Spiezle.

"You have this very complex ecosystem and it was designed to be very efficient, which it is. It's designed to help provide very relevant advertising for the consumer, which it achieves, but also in all the benefits, it's opened its door to be an easy way for cybercriminals to compromise," Spiezle said.

Read MoreInternet ad spend up 32% as old media takes a hit