Spyware Delivered Through Ads Shows Why "Don't Click" Is No Longer Enough

"Be careful what you click" has been standard computer advice for decades. It is still good advice. Unfortunately, some attacks apparently do not need the atual click anymore.

In its October 15 investigation, Citizen Lab documented AdFection, a technique used to deliver Candiru spyware through targeted advertisements. Researchers identified at least 45 devices at Al Jazeera targeted during 2024 and 2025, with evidence connecting the operation to spyware infections.

This is newly published research into earlier attacks. It also does not mean everyone who encountered one of these advertisements became infected. The operation selected very particular targets.

How the Attack Actually Worked

Discover-Tech (Israeli digital advertising agency) bought advertising placements through the existing advertising ecosystem. When one of its advertisements loaded on a website or in an app, embedded code contacted a Discover-Tech server.

That server acted as a gatekeeper. Information such as an IP address or advertising identifier helped determine whether the visitor should receive additional code. Most visitors received no additional JavaScript.

On compromised devices, researchers traced connections from Discover-Tech infrastructure to a Candiru validation server, followed by communication with spyware command-and-control servers. They also recovered a Windows spyware component.

Why Didn't the Browser Ask Permission?

An online advertisement can contain executable JavaScript, rather than just a picture. Browsers routinely run JavaScript automatically to make websites function. Clicking the advertisement is a separate action.

However, running ordinary website code and installing spyware are very different things. Browsers restrict what website code can access. An attack must exploit security weaknesses to cross those boundaries. Depending on the attack, that can require multiple vulnerabilities working together.

Think of the advertisement as the delivery truck. Getting the truck to your driveway does not automatically give someone the keys to your house. The exploit is what attempts to break through the locks.

Citizen Lab documents the delivery infrastructure and infection evidence, but does not identify the exact browser vulnerabilities used in these attacks. We should not fill that gap with guesses and would really like to know exactly how they did this, but we understand why they have not released that information.

Could This Work on Any Computer?

The delivery method has broad reach because advertising appears across computers, phones, websites, and apps. Someone would not necessarily have to visit a shady website to encounter an attacker's advertisement.

But exposure is not the same as successful infection. An exploit generally needs to match the target's browser, operating system, software version, and available vulnerabilities. A Windows attack does not automatically work on a Mac or an iPhone.

That distinction explains why updates matter. Patching a vulnerability can break an attack chain even if the advertisement still reaches your browser. It also explains the value of content blocking. Stopping the delivery request can remove an opportunity for attack before the exploit is attempted.

The concern is broad access to potential victims, not proof of a universal attack that defeats every device.

Why an Advertisement Might Look Harmless During Inspection

Selective delivery creates another problem. A researcher or advertising reviewer might receive an ordinary advertisement, while the intended target receives additional attack code. Looking at the same advertisement does not necessarily mean receiving the same content.

This is also why trusting a website does not automatically establish trust in everything loaded alongside it. The publisher, advertising exchange, advertiser, and other intermediaries can be separate organizations.

For example, here at MajorGeeks, we use Google to serve advertisements. Google's advertising ecosystem connects publishers with a large network of advertisers and agencies. We personally monitor the ads appearing on the site and block suspicious advertisers and unwanted content. However, advertisements can change depending on the visitor, location, device, and time. It is impossible for us to inspect every possible advertisement that every reader might receive.

Following the investigation, Google terminated Discover-Tech's access, blocking it from bidding on or serving advertisements across Google's ecosystem.

Free Software That Can Help Reduce Your Exposure

For MajorGeeks readers, content blockers are a practical place to start. They can block advertising and tracking requests, reducing the third-party content your browser loads.

uBlock Origin is a free option for Firefox users. It blocks ads, trackers, and known malicious sites, with additional controls for people who want to fine-tune what websites can load. github.com

For Chrome users, uBlock Origin Lite is designed for the newer extension system. Its settings include stronger filtering modes, such as Optimal and Complete, which require additional website permissions. Open the extension's panel to review those options. www.majorgeeks.com

Choose the version appropriate to your browser. These tools can reduce exposure, but neither recommendation means they have been proven to stop every AdFection attack.

Using a more consumer-friendly browser could help as well. Google Chrome and Microsoft Edge are pretty much just marketing machines now. More interested in your data than your privacy. Browsers with built-in advertising and tracking protection can help reduce exposure. Brave blocks third-party ads and trackers by default. Opera offers built-in ad and tracker blocking that you should check is enabled. DuckDuckGo Browser blocks many tracking requests before they load, which also blocks advertisements that rely on them. brave.com

The benefit comes from preventing potentially dangerous content from loading in the first place. These features do not establish that a browser is immune to AdFection, and they do not replace security updates. Simply using DuckDuckGo as your search engine does not provide the protections of its browser.

Keep the Rest of Your Protection Working

Keep Windows, your browser, and your security software updated. If a browser update says a restart is required, finish the restart. An update waiting for you to close the browser is not doing much good sitting there.

Keep your browser's built-in protection against dangerous websites enabled, too. Blocking unwanted content, fixing software vulnerabilities, and detecting malicious activity serve different purposes. You want those layers working together.

If your work makes you a likely surveillance target, such as journalism or activism, get qualified security assistance. A clean routine antivirus scan should not be treated as a definitive spyware investigation.

The Geek Take

As someone who runs an advertising-supported website, I would much rather be writing about advertisements becoming less annoying, more useful and a benefit to our users. Having to explain why blocking them can be a security precaution is a lousy commentary on the advertising business.

Readers can make sensible choices, install updates, and use protective software. The companies delivering advertisements also need to take responsibility for what reaches our screens.

"Don't click suspicious ads" remains useful advice. It just cannot carry the entire security plan anymore. We don't blame you for blocking ads, either. But if you do, please consider buying us a coffee to help support the work we put into MajorGeeks. Trust us, it helps. Thanks!

Jim McMahon Jim McMahon, aka Corporal Punishment, is the founder of MajorGeeks.com. He has spent decades testing software, troubleshooting Windows, and helping users cut through the nonsense. He loves real freeware, hates bloatware, and runs on caffeine, sarcasm, and questionable choices.