Insights Security & Privacy
Spyware can now infect phones through ads: what you can do
The short version
The Citizen Lab, a research group at the University of Toronto, has shown spyware infecting devices just because an ad appeared on screen. The ads came from a firm that Google and others have now blocked.
What happened
Researchers found that an Israeli company, Discover-Tech, bought ads that could quietly install spyware on chosen devices. Spyware is software that secretly watches a device. The ads carried hidden code that checked who was viewing and sent attack code only to selected targets.
The researchers linked at least 45 devices at the news outlet Al Jazeera to attacks in 2024 and 2025. Between March and June this year, the company's ads appeared on more than 120,000 websites and 70,000 mobile apps.
Google ended the company's access to its ad platforms, and the advertising body IAB Europe took it off its vendor list. Other ad firms also cut it off.
Why it matters to you
The attack needs no tap and no mistake by the user. The person may not even see the ad. The researchers say blocking ads as thoroughly as possible is about the only protection available.
The known targets were devices at a news outlet, not ordinary shoppers. Even so, the same ad system serves everyone, and it can pass on details such as your device, location and browsing.
What to do
Use an ad blocker in your browser where you can, and block ads as thoroughly as possible on the sites and apps you use.
Limit ad tracking in your phone settings and delete or reset your advertising ID, a number that lets advertisers recognise your device. Remove apps you no longer use, since apps are one place ads are shown.
Sources
- Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware The Citizen Lab (primary source) (opens in a new tab)
- 'Nightmare Scenario': Zero-Click Spyware Is Infecting Phones via Targeted Ads Wired (opens in a new tab)
- Targeted ads delivered 0-click exploits to install mercenary malware Ars Technica (opens in a new tab)
- AdFection: How mercenary spyware invades victims' devices through targeted advertising CyberScoop (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.