Most people think of online ads as an annoyance. A new investigation shows they can also be a weapon. Researchers at the University of Toronto’s Citizen Lab have documented the first publicly confirmed case of ad-based spyware, where government-grade surveillance tools reached phones through ordinary advertisements. The victims did not need to click anything. This kind of zero-click spyware is rare and expensive, but the findings raise serious questions about how the advertising system works, and what everyday users can do to stay safer.
What Citizen Lab Found
In a report published on 15 October, Citizen Lab described a technique it calls AdFection. According to the researchers, an Israeli company called Discover-Tech, which presents itself as a normal digital advertising firm, placed ads containing hidden code. When the ads appeared on a targeted person’s screen, that code could connect the device to spyware infrastructure without any action from the user.
Citizen Lab linked the attacks “with high confidence” to spyware from Candiru, an Israeli firm that sells hacking tools to governments and was blacklisted by the US government in 2021. The investigation began after Al Jazeera asked the researchers to examine suspicious activity, and it identified attacks on at least 45 devices associated with the broadcaster in 2024 and 2025.
The scale is what alarms experts
The targeted attacks were narrow, but the advertising reach was enormous. Citizen Lab says Discover-Tech placed nearly four billion ad bids on one platform between March and June 2026, and that ads carrying the hidden code appeared in about 75,000 apps and 120,000 websites, as The Hacker News detailed. Most people who saw those ads were not infected, but the reach shows how the system could be abused.
How Ad Auctions Became the Weak Point
Every time a webpage or app loads an ad, an automated auction often happens in a fraction of a second. Advertisers bid to show you an ad, and to help them decide, the system shares details about your device, location and interests. This process is called real-time bidding.
Citizen Lab says that data flow is what made AdFection possible. Because bidders receive information that can single out a specific device, a malicious advertiser can aim content at one person while showing ordinary ads to everyone else. That also makes the code hard to catch, because what one person sees can differ completely from what an ad checker sees. Reports say Google has banned the ad vendor involved.
Who Is Really at Risk?
It is important to keep this in perspective. Mercenary spyware is costly and is usually aimed at specific people, such as journalists, activists, lawyers, politicians and business leaders. Most Australians are unlikely to be targets of this particular attack.
The broader lesson still matters for everyone. The same advertising data that enabled this attack is collected about almost all of us, every day. Citizen Lab is calling on regulators to investigate and to strip personal data out of real-time ad auctions, arguing the current system creates a recipe for abuse. Concerns about who can watch what we do are growing across tech, from social media feeds to office meeting rooms, as our report on the OpenAI recording device arrest shows.
Practical Steps to Protect Your Phone
No single setting makes you immune to advanced spyware, but simple habits reduce your exposure to risky ads and many common threats:
- Update quickly. Install operating system, browser and app updates as soon as they arrive, since they often patch the holes spyware relies on.
- Limit ad tracking. On iPhone, turn off Allow Apps to Request to Track in privacy settings. On Android, delete or reset your advertising ID in the privacy or ads settings.
- Use content blocking. A reputable browser with built-in tracker and ad blocking reduces how many ads load in the first place.
- Remove apps you do not use. Fewer ad-supported apps means fewer places for malicious ads to appear.
- Restart regularly. Rebooting your phone can disrupt some types of malware that do not survive a restart.
- Use extra protection if you are high-risk. iPhone users who may be targeted can turn on Lockdown Mode, which limits features attackers commonly exploit.
The Australian Cyber Security Centre also publishes free guidance on securing phones and accounts. Reviewing how much data you share with platforms helps too, as our guide to Facebook’s Your algorithm tool explains for social media. Our cybersecurity tips for small businesses in Australia guide covers workplace devices.
Ads Are Part of the Security Picture Now
AdFection shows that the advertising system, built to sell us products, can also be turned against us. Most people will never face a targeted spyware attack, but the data that made it possible is collected about nearly everyone. Keeping your phone updated and limiting ad tracking are simple steps that make every kind of attack harder.
Frequently Asked Questions
Can an ad really hack my phone without a click?
According to Citizen Lab, yes, in these targeted cases. The ad’s hidden code ran when it appeared on screen, which is why it is called zero-click.
Will an ad blocker fully protect me?
It reduces your exposure, but no tool is perfect. Combine it with quick updates and careful app choices.
Should I worry about my everyday banking apps?
This report concerns spyware delivered through ads, not banking apps themselves. Keep those apps updated and download them only from official app stores.
Have the companies responded?
Citizen Lab says it contacted the firms named in its report and received some responses. Readers can find the full details in the published report.