Can Even Watching Ads Infect Your Phone with Spyware? New Attack Method

You might not even have to click on an ad

Imagine reading the news on your phone. An ad is loading at the bottom of the page. You don't touch the ad, you don't download any files, you don't even notice that you opened a suspicious link. However, your device may be compromised in a specifically targeted attack.

Citizen Lab research cited in Ars Technica's news dated October 15, 2026, reports that zero-click attacks were carried out through targeted ads in a campaign called AdFection. Researchers state that they confirmed that 45 devices at the international media outlet Al Jazeera were infected with this campaign in 2024 and 2025. It is reported that the attacks include iOS and Android devices.

The critical detail here is that the victim does not have to open the ad on purpose. The attacker can try to exploit a software vulnerability on the device by using the ad display chain.

How does the attack chain work?

Normally, the digital advertising system acts as an intermediary between the advertiser and the site or application that displays the advertisement. An ad network may include multiple companies and systems that decide which ad to show to which user.

In the attack model described in the research, advertising is not just a commercial image. The code executed when the ad is shown can be used to collect information about the target device or reach a control server. Then, if there is a suitable security vulnerability, the malicious payload can be transmitted to the device.

Citizen Lab research, the adware broker Discover-Tech played a role in connection with multiple commercial spyware providers. Researchers report that the campaign used products from a spyware developer known as Candiru, later associated with the Integrity Labs brand.

But there is a limit here: The research does not publicly disclose all the vulnerabilities used in the attacks and all the technical details of the late-stage malware. Therefore, it would be wrong to say that every ad works this way or that all ordinary users are targeted.

What can you do to protect yourself?

User behavior alone is not enough against zero-click attacks. However, it is possible to reduce the attack surface.

1. Keep operating system up to date. On iPhone, Settings → General → Software Update; On Android, check Settings → System or Software update. Menu name may vary depending on manufacturer.

2. Update your browser. Even if your phone's operating system is up to date, check for browser updates separately.

3. Remove unnecessary apps. Applications that you do not use and whose sources you are not sure of can expand the attack surface.

4. Consider ad blocking options. Reliable content blockers or network-level filtering can prevent some malicious ads from loading.

5. Enforce security policies on enterprise devices. Especially for journalists, managers, and those working with sensitive information, enterprise mobile device management and threat detection may be more meaningful.

6. When you see a suspicious ad, don't just close it. If you are using a corporate device, report the time of the incident and the page opened to the security team.

Resetting the advertising ID or limiting personalized ads on iOS and Android may reduce ad profiling. However, these actions do not close the operating system vulnerability and do not provide definitive protection against zero-click attacks.

What does it mean in real life?

The important thing about this research is that it does not focus solely on users' carelessness. Intermediaries in the advertising ecosystem also bear security responsibilities. If an ad network doesn't adequately monitor advertisers, the problem doesn't just lie with the website that publishes the ad.

According to Ars Technica, some ad platforms have terminated their relationships with Discover-Tech or suspended their access during the investigation.

Quick conclusion: There may not be a link you accidentally clicked at the beginning of every malware that can infect your phone. It is therefore important not to delay updates, reduce the risk of advertising, and use corporate security measures, especially in sensitive work.