Is Viewing an Ad Enough to Trigger a Cyberattack? The Growing Risk of Zero-Click Attacks
Cybersecurity threats are no longer limited to suspicious links, malicious downloads, or obvious user mistakes. In some attack scenarios, simply viewing digital content may be enough to put a device at risk.
When browsing the web, reading the news, or using a mobile application, most of us consider digital advertisements a routine part of the online experience. We may ignore them, close them, or scroll past them without a second thought.
But what if an advertisement could become the starting point of a sophisticated cyberattack without requiring a single click?
Research published by the University of Toronto's Citizen Lab on October 15, 2026, has brought this question into sharper focus. The researchers documented a targeted advertising-based attack technique they named AdFection, providing technical evidence that digital advertising infrastructure can be abused to deliver mercenary spyware.
The implications go beyond advertising security. They challenge some of the assumptions organizations have traditionally made about how cyberattacks begin.
What Is AdFection and How Does It Work?
The digital advertising ecosystem is built on a complex network of advertising exchanges, technology providers, publishers, and advertisers. This infrastructure enables advertisements to be delivered to specific audiences based on various signals and targeting criteria.
However, the same infrastructure can potentially be abused for surveillance and targeted cyber operations.
The AdFection research illustrates how this process can work in several stages:
Target identification: Signals associated with a user or device are evaluated to identify potential targets.
Ad delivery: An advertisement is displayed through a website or mobile application. Depending on the implementation, the advertising code may collect information about the device and initiate further actions.
Targeted exploitation: Selected devices may be exposed to additional code or browser exploits. If the relevant vulnerabilities can be exploited successfully, spyware installation may become possible.
An important distinction must be made: viewing an advertisement does not automatically mean a device has been compromised. Successful exploitation depends on the attack chain, the techniques involved, and the security posture of the target device.
Nevertheless, the research highlights a critical risk: an ordinary advertising impression can potentially serve as the entry point for a sophisticated attack.
What Did the Research Reveal?
According to Citizen Lab, at least 45 devices belonging to Al Jazeera personnel were targeted during 2024 and 2025. The researchers linked the attacks to spyware associated with Candiru and to advertising infrastructure connected to a company called Discover-Tech.
The investigation also examined approximately four billion advertising bid records. Over a four-month period, the associated advertisements appeared across roughly 200,000 distinct websites and mobile applications.
These figures should not be interpreted as evidence that hundreds of thousands of devices were compromised. An advertisement being served, a device being targeted, an exploit being attempted, and a successful infection are different stages of an attack.
The significance lies elsewhere: a large-scale digital advertising ecosystem can potentially be leveraged to reach specific individuals or devices.
Unlike conventional phishing campaigns, which typically depend on a recipient opening a malicious link or attachment, advertising-based delivery may reduce the need for direct interaction with the target.
Why Trusted Websites Are Not Always Enough
A website may be trustworthy without every advertisement or third-party component displayed on it being equally trustworthy.
Modern websites rely on external advertising networks, analytics tools, content delivery services, and embedded scripts. These components make digital services more dynamic, but they also expand the number of external elements that can affect a user's browsing experience.
Even when a publisher maintains strong security practices, it may not have complete control over every component in the advertising delivery chain.
An advertisement may also behave differently depending on the target, the device, or the conditions under which it is delivered.
This means that assessing a threat solely by looking at an advertisement or deciding whether a link appears suspicious is no longer sufficient.
The more important questions are:
What is the content doing behind the scenes?
Which external domains and services is the device communicating with?
Can unusual behavior be detected before significant damage occurs?
These questions should be part of a broader cybersecurity strategy.
Beyond Spyware: A Wider Security Challenge
AdFection is not the only research effort highlighting the potential misuse of advertising technology for surveillance.
In December 2025, Amnesty International's Security Lab published findings from its investigation into Intellexa's commercial spyware ecosystem. The research described a technique known as Aladdin, involving the potential use of targeted digital advertising to reach devices associated with the Predator spyware ecosystem.
These investigations concern different operations and should not be treated as evidence of a single campaign. However, considered together, they demonstrate why advertising infrastructure deserves greater attention in modern threat modeling.
For organizations, the implications can extend well beyond individual privacy.
A senior executive's smartphone may contain confidential communications, customer information, business negotiations, authentication tokens, and access to corporate systems. A compromise affecting that device could therefore become a broader organizational security incident.
The risk is particularly relevant for executives, government officials, journalists, security professionals, and employees who regularly handle sensitive information.
What Should Organizations Do?
There is no single security product that can eliminate every risk associated with zero-click attacks. Organizations need a layered defense strategy that combines endpoint protection, network visibility, threat intelligence, and effective incident response.
1. Strengthen Endpoint Security
Operating systems, browsers, and applications should be kept up to date. Endpoint security solutions should monitor suspicious processes, unexpected behavior, and indicators of exploitation.
Patching known vulnerabilities promptly is especially important because some sophisticated attacks rely on weaknesses that already have available fixes.
2. Improve Network Visibility
Organizations should understand which domains their devices communicate with, when unusual connections occur, and whether unexpected data transfers take place.
DNS security and Network Detection and Response (NDR) can provide additional visibility into suspicious communication patterns when integrated into a broader security architecture.
3. Review Advertising and Third-Party Content Risks
For devices used to access sensitive systems or information, organizations should consider limiting unnecessary advertising and tracking components.
Stricter browser policies, reduced exposure to untrusted third-party scripts, and dedicated protections for high-risk users can help reduce the attack surface.
4. Integrate Threat Intelligence
Known malicious domains, suspicious infrastructure, and relevant indicators of compromise should be incorporated into security monitoring and response workflows.
However, organizations should not rely exclusively on known indicators. Targeted attacks may use new infrastructure or techniques that have not yet been identified by threat intelligence feeds.
Behavioral detection and contextual analysis remain essential.
5. Prepare for Incident Response
Security teams should have clearly defined procedures for investigating suspicious devices, isolating affected systems, preserving forensic evidence, and escalating incidents.
When mercenary spyware is suspected, specialized digital forensics expertise may be required. Prematurely resetting a device or deleting data can destroy evidence that would otherwise help establish what happened.
6. Apply Risk-Based Protection to High-Value Users
Executives, privileged users, and employees with access to sensitive systems may require additional safeguards.
Organizations should assess their threat models and determine whether enhanced device restrictions, hardened browsing environments, additional monitoring, or dedicated mobile security measures are appropriate.
The objective is not to apply identical controls to every user, but to align protection with actual risk.
Rethinking Cybersecurity for a Zero-Click World
User awareness remains a fundamental part of cybersecurity. Recognizing phishing emails, avoiding suspicious downloads, and refusing to open untrusted attachments are still important practices.
But these measures cannot address every attack scenario.
If a threat can begin without a user clicking a link, downloading a file, or knowingly taking an action, security cannot depend exclusively on user behavior.
Organizations must also be able to identify what happens on their devices, observe how those devices communicate across networks, and recognize unusual activity as early as possible.
This requires a more integrated approach to cybersecurity, combining endpoint protection, DNS security, network monitoring, threat intelligence, and incident response.
The key question is no longer just, "What did the user click?" It is also, "What happened on the device when the user did nothing at all?"
As digital threats evolve, the ability to detect suspicious behavior without relying on visible user interaction will become increasingly important.
Cybersecurity is not only about preventing users from making mistakes. It is about building systems capable of identifying threats even when users have no reason to suspect that anything is wrong.
Sources and Further Reading
Citizen Lab — Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (October 15, 2026).
Confiant — ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (October 15, 2026).
Amnesty International Security Lab — To Catch a Predator: Leak exposes the internal operations of Intellexa’s mercenary spyware (December 2025).
This article provides an analysis of publicly reported research and its implications for enterprise cybersecurity.
Comments