New Zero-Click Spyware Infects Devices Through Web Ads
Researchers have documented a novel method that compromises devices silently while an advertisement is being viewed.
Updated on Oct. 15, 2026 in Cybersecurity
Live Poll
Do you trust that viewing online advertisements is safe for your device security?
Citizen Lab researchers have documented the first public technical proof of a zero-click mercenary spyware technique. Named AdFection, this method compromises devices simply by having a user view a targeted online advertisement.
Why it matters
This development identifies a new, silent attack vector that bypasses traditional user-interaction security hurdles. By weaponizing ad-delivery networks, the spyware presents a significant threat to device integrity that occurs entirely without user action.
The AdFection technique represents the first documented instance of zero-click delivery via targeted ads. This proof confirms that a device can be fully compromised during the simple rendering process of an advertisement.
The players
Citizen Lab
A research laboratory based at the Munk School of Global Affairs and Public Policy at the University of Toronto that investigates digital threats, spyware, and censorship.
The details
The AdFection spyware functions by exploiting vulnerabilities within the browser or application environment responsible for displaying online advertisements. When a target views the infected ad, the software initiates a background process that executes malicious code to gain unauthorized control of the device. This mechanism requires no interaction like clicking links or downloading files, as the infection occurs automatically upon the impression of the ad.
Timeline
October 15, 2026: Citizen Lab publishes findings on the AdFection spyware.
The Tech Race
This discovery updates the threat landscape for mobile security by shifting from link-based vectors to passive, ad-based delivery. It forces a recalibration of detection priorities similar to the industry-wide response following the 2021 Pegasus spyware forensic investigations.
Users currently have no standard way to prevent ad-based zero-click infections, as the exploit occurs through the passive act of viewing an advertisement. The discovery highlights the critical necessity for robust browser and system-level security updates to mitigate silent delivery vectors.
The takeaway
The emergence of AdFection demonstrates that passive web engagement can now lead to full device compromise. Watch for security patches from major browser developers and ad-network operators responding to this proof-of-concept discovery.
Further reading
For ongoing coverage of digital vulnerabilities, visit the Cybersecurity section.
Live Poll
Do you trust that viewing online advertisements is safe for your device security?
