This is how an ordinary advertisement became a delivery route for spyware, the names of the tricks behind it, and what actually protects your phone and laptop.
What actually happened
In October 2026 the Citizen Lab, a research group at the University of Toronto that tracks commercial spyware, published an investigation that documented, for the first time, phones and laptops being infected with spyware through a targeted advertisement, with no click from the owner. The ads were sold by a company called Discover-Tech. The spyware itself was built by a company called Candiru, which now goes by the name Integrity Labs.
The reason this is possible is that an ad is no longer just a picture. When an ad loads, it usually runs a small piece of code, JavaScript, inside your browser. That code reports back to the seller’s server with your IP address, which is the number that identifies your connection, and the advertising ID tied to your device. If you are an ordinary visitor, the server sends back nothing at all: zero bytes, and nothing happens. If you are the target, it sends back code that tries to use a security hole, a weakness in the browser or the operating system, and then drops the spyware file.
People usually stop at the click. The click is not part of it. An ad can load in the background while you never see it, and the sequence is the same: code runs, a hole is used, a file is written.
Why this is about you, not just journalists
The file that lands does not take one screenshot and leave. It collects your documents, your browser cookies (small files that keep you signed in and store saved passwords), every keystroke you type, screenshots, microphone and camera recordings, and messages from chat apps. It encrypts its own traffic and sends the stolen data in small chunks over time, precisely so that security software does not notice.
What makes it worse is that the plumbing is everywhere. One analysis of four billion ad auction records found the company’s ads appearing on almost 200,000 websites and apps across dozens of countries. So you cannot protect yourself by judging whether a site looks suspicious. A perfectly respectable site can carry an ad from the same network.
What you can actually do
- Install an ad blocker in your browser and leave it on for every site. This is the single most effective step, because it stops the ad’s code from loading in the first place, instead of relying on your judgement about the site.
- Leave automatic updates on, on your phone and your laptop. Most of the holes used in attacks like this are closed by an ordinary update that people postpone by two weeks.
- Turn on network-level filtering, a DNS service that blocks advertising and tracking domains before they reach your device. It is one setting on your router or your phone.
- On an iPhone, if you work in journalism or human rights, turn on Lockdown Mode. It is a stricter protection mode that gives up some features in exchange for a smaller attack surface. On Android, enrol in Google’s Advanced Protection programme.
- On a computer, update the browser, remove extensions you do not use, and reject third-party cookies more often.
- On Windows, turn on the allowed-apps list, a setting that refuses to run anything that is not already known.
- After any suspicion, change your main passwords and turn on security keys, a way of signing in that uses a physical device instead of a typed password.
The names you will hear
These come up in almost every investigation into digital surveillance. You do not need to become an expert, but knowing them makes the news readable.
- Zero-click is an attack that needs no click from you at all.
- Malvertising is malicious advertising that hides inside legitimate ad networks.
- AdFection is the name the researchers gave to delivering commercial spyware through a targeted ad.
- ADINT stands for advertising intelligence: pulling information about people out of ad auction data itself.
- RTB is real-time bidding, the auction that sells ad space hundreds of billions of times a day and hands over device details before the ad even appears.
- WebRTC IP leak is a flaw that reveals your real address even when you use a VPN.
- HTTP header enrichment and X-MSISDN describe how some mobile networks attach your phone number to your requests, which can then be read by a website.
- Zero-click login is an automatic sign-in that relies on the same mechanism, and becomes a way to expose your number.
- Fingerprinting is a device fingerprint built from how your screen renders graphics through Canvas and WebGL, so you can be recognised without cookies.
- COM hijacking is a Windows persistence trick that makes a program start again after every reboot.
- CVE-2023-4863 is a real hole in the WebP image library inside Chrome that was exploited in the wild.
- CVE-2023-41064 is a real hole in how the iPhone handled images, exploited without a click.
CVE is the official tracking number every known vulnerability gets, and it is what appears in security advisories. Every one of the above was closed by an update. That is why postponing updates is the actual problem, not a lack of knowledge.
Common misunderstandings
“I never click ads, so I am fine”
The attack does not need a click. In some cases loading the ad is enough on its own.
“I have antivirus, so I am protected”
Antivirus catches files it already knows. Commercial spyware is changed for each target.
“Apps from the official store are safe”
The ad arrives inside the app itself. Nothing has to be installed by you.
“A VPN protects me”
A VPN hides your address from the website. It does not stop an ad’s code from running on your device.
What to watch next
Pressure on the advertising side has grown. After the investigation the company was dropped from approved-vendor lists, and one of the largest ad operators cut off its access to its ad exchanges. But this self-regulation still rests on companies describing themselves accurately, and real change will come from rules that limit how deeply profiles about people can be built in the first place.
The one thing to remember
You can no longer tell from the look of an ad whether it is dangerous, so stop your device from loading ads at all, and stop postponing your updates.