You didn’t click anything. The advert was enough.

Researchers have confirmed that targeted online adverts were used to deliver spyware without a click. For businesses, it is another reason to treat ad blocking as part of security—not just a way to tidy up the screen.

“Don’t click suspicious links” is sensible advice. But it only protects against attacks that need you to click.

A new investigation by the University of Toronto’s Citizen Lab has documented something more concerning: commercial spyware delivered through online advertising, with no interaction required from the person using the device.

The advert could appear on a perfectly ordinary website or inside an app. Loading it was enough to start the attack.

That does not mean every advert is dangerous, or that every device shown one was infected. It does mean that careful browsing alone cannot cover every risk.

How an advert becomes a delivery route

Online adverts are often more than pictures and text. They can contain code used to measure views, identify devices and load content from other servers.

When you open an ad-funded website or app, an automated auction can decide which advert you see. Information about your device and browsing context helps advertisers decide whether to bid.

According to Citizen Lab, an Israeli company called Discover-Tech used this system to connect spyware operators with the people they wanted to reach.

Its platform could target devices using advertising identifiers, browser identifiers and IP addresses. When one of its adverts loaded, it contacted the company’s servers. Selected recipients could then be sent further code leading to a spyware infection.

The malicious part did not have to sit openly inside the original advert. It could be supplied later, and only to the intended target, making it harder for advertising platforms and security scanners to spot.

What the researchers actually proved

Citizen Lab calls the technique AdFection.

Its strongest evidence concerns attacks against Al Jazeera in 2024 and 2025. Researchers identified at least 45 targeted devices and found high-confidence evidence that devices had been infected with Candiru spyware.

Their findings included network logs tracing the route from advertising infrastructure to spyware servers, alongside a spyware component recovered from a compromised Windows device.

The wider advertising operation was substantial. Analysis of roughly four billion bidding records showed Discover-Tech adverts appearing across almost 200,000 websites and mobile apps over four months.

There is an important distinction here: an advert being displayed is not proof of a spyware infection. The researchers found widespread exposure and profiling, with evidence of infection in specific cases—not proof that millions of devices had been hacked.

Following disclosure, Google cut off Discover-Tech’s access to its advertising exchanges, and several other advertising businesses took action.

Why this matters to an ordinary business

This investigation concerns sophisticated, targeted surveillance. It is not evidence that the average small business is about to face the same spyware operation.

But the weakness it exposes is relevant much more widely.

A trusted website can load advertising supplied by third parties. A useful mobile app can do the same. The organisation whose name appears at the top of the screen is not necessarily supplying everything running underneath it.

That changes the security conversation. Asking staff to be vigilant is still worthwhile, but it cannot prevent an attack that starts without a decision from them.

Practical steps worth taking

Keep software updated. The advert supplies the route in; compromising the device still depends on exploiting a software weakness. Operating systems, browsers and apps all need attention.

Review ad and tracker blocking. Citizen Lab recommends blocking advertising and tracking on devices and at organisational gateways. Browser protection and network filtering can complement each other, although neither should be treated as a guarantee.

Include phones and tablets. A desktop browser extension does not protect adverts loading inside a mobile app. Business security policies need to cover the devices people actually use for work.

Reduce unnecessary tracking. Restricting app tracking and disabling advertising identifiers where available can reduce the information used to identify and follow a device.

Do not rely on a VPN alone. A VPN does not inherently stop an advert or its code from loading.

The lesson is not to panic about every banner advert. It is to stop treating advertising as something with no bearing on business security.

“Don’t click” remains good advice. It just cannot be the whole policy.

Not sure what protection is in place across your business browsers, phones and network? Talk to Datasouth about reviewing the gaps.

Sources: Citizen Lab investigation and executive summary · Confiant’s accompanying technical analysis