Researchers Warn Online Adverts Can Deliver Zero-Click Spyware Without Users Clicking

Online advertisements could expose internet users to sophisticated spyware even when they do not click on anything, cybersecurity researchers have warned, raising fresh concerns about the safety of digital advertising platforms.

A new investigation by the University of Toronto’s Citizen Lab and advertising security firm Confiant has uncovered evidence that an advertising network was used to facilitate attacks against selected devices through ordinary online adverts.

The investigation, published on October 15, 2026, identified a technique researchers call AdFection. It allows attackers to exploit advertising infrastructure to identify potential targets and deliver spyware without requiring them to open a suspicious link, download a file or approve an installation.

According to Reuters’ report on the investigation, Israeli advertising firm Discover-Tech allegedly worked with surveillance companies to track users and help compromise devices through advertisements distributed across major digital platforms.

The findings highlight a serious cybersecurity concern because online adverts are displayed across websites and mobile applications that people use every day. An advert promoting an ordinary consumer product may appear harmless, yet the technology delivering it can potentially be abused to collect information or exploit security weaknesses.

How Zero-Click Spyware Attacks Work Through Online Adverts

Traditional cyberattacks often depend on users clicking malicious links, opening infected attachments or installing harmful applications. Zero-click spyware attacks are different because they can succeed without such interaction.

In the campaign documented by Citizen Lab, advertisements could trigger code that communicated with servers operated by Discover-Tech. Depending on the targeting instructions, the infrastructure could identify particular devices and deliver additional code intended to exploit vulnerabilities.

The researchers said this approach could allow spyware to reach selected targets when an advertisement was displayed, even if the user did not knowingly interact with it.

The investigation linked the operation to Candiru, an Israeli spyware developer also known as Integrity Labs following a rebranding. The researchers traced attacks against devices associated with international broadcaster Al Jazeera during 2024 and 2025, identifying at least 45 targeted devices.

As explained in the Citizen Lab investigation, the researchers analysed network records and technical evidence connecting advertising activity with infrastructure associated with the spyware operation.

Not every advert served through the network was necessarily malicious. However, the findings demonstrate how advertising systems designed for targeted marketing can also be exploited for surveillance and sophisticated cyberattacks.

Major Advertising Platforms Face Questions Over Security

The investigation also raises questions about how companies vet advertisers and monitor the technology used to deliver digital campaigns.

Citizen Lab reported that Discover-Tech’s advertisements appeared across more than 120,000 websites and tens of thousands of mobile applications. Its analysis also identified advertising activity linked to government networks, international institutions and other sensitive environments.

Reuters reported that the company’s advertising relationships extended to major platforms, including Google, Comcast and Yandex.

Following the investigation, Google terminated Discover-Tech’s access to its advertising exchange platforms. Other industry participants also took action, while the European branch of the Interactive Advertising Bureau suspended the company from its vendor list.

These measures demonstrate the importance of cooperation between advertising companies and independent security researchers. However, removing a single advertiser does not necessarily resolve the wider weaknesses that make such attacks possible.

The advertising industry relies on complex automated systems that process enormous numbers of transactions and distribute adverts within milliseconds. Researchers warn that inadequate oversight of these systems can create opportunities for malicious actors to hide harmful activity within legitimate commercial operations.

Back Story: What the Findings Mean for Internet Users

The latest findings build on longstanding concerns about online tracking, personal data collection and the commercial use of information gathered from internet users.

Digital advertising systems routinely process identifiers and technical information to decide which adverts should appear on a device. While these mechanisms support personalised advertising, researchers say the same infrastructure can be abused to identify individuals and direct sophisticated attacks at them.

The risk is particularly concerning for journalists, government officials, business executives and other people who may be targeted for sensitive information. However, the investigation does not mean every internet user who sees an advertisement has been infected.

For Nigerians, the findings reinforce the importance of keeping phones, computers, browsers and applications updated. Users should also consider reputable ad-blocking tools, review app permissions and avoid installing software from untrusted sources.

Organisations handling sensitive information should strengthen device security, monitor suspicious network activity and consider limiting advertising and tracking on work devices.

Nevertheless, ordinary precautions cannot guarantee protection against advanced zero-click attacks. Researchers argue that advertising platforms must improve advertiser verification, scrutinise suspicious code and strengthen their ability to detect malicious campaigns before they reach users.

The central lesson is clear: online safety depends not only on individual behaviour but also on the security of the digital systems through which people access the internet.