Summarize this blog article with AI:
Ask ChatGPT
Ask Grok
Ask Perplexity
Ask Claude
Ask Google AIMost internet users know not to click suspicious advertisements. But what if an ordinary-looking ad could compromise your device without a click?
Documented spyware attacks show that even routine browsing can pose risks to personal privacy and sensitive business information. But does simply seeing a malicious ad mean you're infected, and what can be done to reduce the risk?
What Is AdFection?
AdFection is a technique for delivering zero-click spyware through targeted online advertisements. It turns the ordinary act of loading an ad into an opportunity to attack a selected device, without requiring a click.
The University of Toronto's Citizen Lab coined the term in October 2026 after documenting spyware infections delivered through online ads. AdFection describes the delivery technique, not a particular spyware product or campaign.
How Does an AdFection Attack Work?
Online advertisements are not always static images. Advertising systems can use device identifiers to reach particular users, while an ad can load code automatically. AdFection combines these capabilities to identify potential victims and deliver spyware exploits through seemingly ordinary ads.
Here is how the attack can progress, from ad placement to spyware infection.[1]
1. Reach a device through an ad
Advertising platforms can show ads based on identifiers such as an IP address or mobile advertising ID. The ad then loads on a website or in an app the person uses.
2. Check the device and decide what to send
Code associated with the ad can gather device details and contact an outside server. The server then decides whether to return additional code, including an exploit, or simply use the information collected.
3. Exploit a security flaw
The next stage attempts to break through security protections in the browser, app or operating system. Exploits may use known, unpatched vulnerabilities or previously unknown zero-day flaws. Ordinary ad code lacks the permissions needed to take over a device, so the exploit must obtain greater access.
4. Run spyware after compromise
Once the exploit succeeds, spyware can operate beyond the ad's normal restrictions. Depending on its capabilities, it can access sensitive information, monitor activity and communicate with its operator.
Real-World Evidence of AdFection
In October 2026, Citizen Lab documented how Discover-Tech, an advertising technology company, helped connect targeted advertising to spyware developed by Candiru (also known as Integrity Labs), a commercial spyware vendor. The researchers analyzed nearly four billion advertising bids from March to June 2026 and identified Discover-Tech ad placements across almost 200,000 websites and mobile apps.[1]
At international news organization Al Jazeera, at least 45 devices were targeted during 2024–2025. Investigators linked successful infections to Candiru using network logs and a malicious Windows file recovered from a compromised device. The particular vulnerabilities exploited were not identified.[1] [2]
Following the researchers' disclosures, Google terminated Discover-Tech's access to its ad exchanges, Beeswax removed its access, Eskimi blocked its accounts and domains, Vungle (Liftoff) paused access pending review, and IAB Europe removed it from its vendor registry.[1]
What did the real advertisements look like?
The advertising creatives associated with Discover-Tech often looked like everyday promotions. Citizen Lab captured these examples on mainstream websites and inside a mobile app.
Citizen Lab · Figure 4 · Ads appearing in ordinary browsing and apps
Examples captured on the CBC and Yahoo websites and in an Android Sudoku app. Source: Citizen Lab, Figure 4 ↗
Citizen Lab · Figure 23 · AliExpress / UGREEN-branded creative
A sale banner featuring AliExpress and UGREEN branding was used in multiple Discover-Tech campaigns. Citizen Lab found no evidence the two brands had a business relationship with Discover-Tech. Source: Citizen Lab, Figure 23 ↗
Image credits: Citizen Lab, University of Toronto, Figures 4 and 23 (15 October 2026).
Further reading: For a closer look at a documented attack, see Sangfor FarSight Labs' article, AdFection: The Zero-Click Compromise, which examines the Discover-Tech and Candiru operation based on findings published by Citizen Lab and Confiant.
How Can You Reduce the Risk of AdFection?
Because AdFection can begin when an ad loads, avoiding suspicious clicks is not enough. The most useful precautions reduce exposure to advertising code and strengthen devices against exploitation.
For individuals
- Block unwanted ads and trackers. Use a trusted ad blocker or a browser with built-in tracking protection.
- Keep software updated. Apply security updates for browsers, apps and operating systems promptly.
- Limit advertising identifiers. Restrict personalized advertising and reset or disable mobile advertising IDs when supported.
For organizations
- Filter risky ads and trackers. Use web security controls such as Sangfor Athena SWG to classify advertising sources and filter unwanted or risky ads with cloud-based threat intelligence. Complement them with DNS filtering, managed browser controls and limits on advertising identifiers.
- Harden and protect endpoints. Keep operating systems, browsers and apps patched, enable exploit mitigations and apply stricter policies to high-risk devices. Endpoint protection such as Sangfor Athena EPP adds protection against malicious activity.
- Connect security signals. Use Sangfor Athena XDR to correlate suspicious web activity with endpoint behavior and network connections. AI-assisted investigation can help analysts identify potential attack chains that isolated alerts might miss.
- Assess alerts in context. Draw on Sangfor threat intelligence and FarSight Labs research to evaluate suspicious indicators. Athena XDR's IOC and IOA matching can help prioritize findings by relevance, freshness and local evidence rather than treating every ad exposure as an infection.
Frequently Asked Questions About AdFection
No. An ad can collect information without delivering an exploit. Even when an exploit is sent to a selected device, it has to succeed before spyware can run.
AdFection is a specialized form of malvertising. Malvertising includes scams, redirects, phishing and malware delivered through ads; AdFection refers specifically to targeted zero-click spyware delivery.
Both can be targeted. Advertising reaches desktop browsers and mobile apps, while successful infection depends on an exploit suited to the device.
Not reliably. The visible creative can look entirely ordinary; the attack is carried through its code and connections to other servers.
No. Ad and tracker blocking reduces exposure, but browser blockers may not cover advertisements inside other apps. Combine them with software updates and other device protections.
