Spyware That Needed Only an Ad to Load. I Am Not Changing a Thing.

My verdict: this is a real risk of using the internet, and the best everyday defense against it is one I already use: an ad blocker.

Citizen Lab, a research group at the University of Toronto, has published a report on a technique it calls AdFection. An Israeli advertising company, Discover-Tech, ran ordinary looking ads that sent each device’s advertising ID and internet address back to its server. That server decided who was a target, and only those devices received attack code. No click required. Citizen Lab says at least 45 devices inside Al Jazeera were targeted in 2024 and 2025, and links those attacks with high confidence to spyware from Candiru, a company the US government blacklisted in 2021. Discover-Tech’s ads reached more than 120,000 websites and 75,000 apps, and also showed up on networks belonging to NATO and the European Commission, among others. Google has removed the company from its ad platforms.

I had never heard of an infection that did not need even a click. Apparently it exists. It still does not change my setup, because my setup already assumes ads are not to be trusted.

I run an ad blocker on my phone and on my computer, and I always have. Citizen Lab’s own advice points the same way: use a trusted ad blocker in the browser, consider one on your home network, reset your mobile advertising ID and turn off ad tracking. The report is careful not to promise that this stops every version of the attack, and it warns the attack surface may be larger than what it found. So treat it as reducing the risk, not removing it.

In most cases an ad blocker does the job. It blocks every kind of banner. The catch is that some sites will not let you continue until you turn it off, and at that point it depends on the site and on you.

If you work in journalism, government or anything else that makes you worth spying on, Citizen Lab recommends getting expert help. For everyone else, the report is long but readable, and it is linked below. Read the protection section yourself.