Most of us treat online ads as an annoyance. They slow down a page, follow us around the internet, and try to sell us something we do not need. But recent technical research has confirmed a more serious possibility: a targeted advertisement can be abused as part of a zero-click spyware attack.
The technique is called AdFection. It shows why online advertising is not only a privacy problem. When the systems behind targeted ads are misused, they can become a path for surveillance and device compromise.
What is AdFection?
AdFection is a name for spyware delivery through the online advertising ecosystem. Instead of sending a suspicious link, tricking someone into installing an app, or waiting for them to open a malicious attachment, the attacker uses a targeted ad placement.
The important detail is that the victim may not need to click anything. The ad only has to render in a browser or app. In some cases, the ad may not even be visible in a meaningful way because advertising code can load in the background.
A typical attack chain can look like this:
- An advertising system identifies a device that matches a chosen target.
- An ad is delivered to a website or mobile app the person is using.
- The advertising code collects identifiers and checks whether the device is the intended target.
- If the device matches and a usable vulnerability is available, the attacker can attempt to run exploit code and install spyware.
This is called a zero-click attack because the person does not need to press a button, approve a download, or type a password for the attack to begin.
Why this is more serious than a normal malicious ad
Malvertising is not new. Criminals have used ads to redirect people to scam pages and fake software downloads for years. AdFection is more serious because the advertising system itself can help an attacker find a specific person or device.
Modern ad-tech systems are designed to decide, in milliseconds, which ad should appear in front of which user. To do that, they can process data such as a device advertising ID, browser identifiers, IP address, location clues, app activity, and inferred interests.
That same targeting machinery can be misused for reconnaissance. An attacker can use it to work out whether a chosen device is online, where it appears to be, and whether it looks worth attacking.
I have already explained why reducing online tracking matters in my guide on how to reduce tracking without breaking everything. This case adds an important point: less ad-tech profiling is not only better for privacy. It can also reduce the information available to people trying to target you.
Can an ad really infect a phone or computer?
Yes, but the risk needs to be explained honestly.
A normal advertisement cannot magically take over every device. A successful zero-click infection normally depends on a real software vulnerability, an exploit that works against the target's device, and a highly capable attacker. That makes this very different from everyday spam or ordinary pop-up scams.
Still, the documented case matters because it proves that a targeted ad can be used as the delivery path. The threat is especially relevant to journalists, activists, government staff, executives, researchers, and anyone whose work makes them a high-value surveillance target.
For most people, the practical lesson is not to panic about every banner ad. It is to keep devices updated, reduce unnecessary tracking, and avoid treating advertising systems as harmless by default.
What spyware could do after a compromise
The exact capability depends on the spyware and the permissions it obtains. Powerful commercial spyware can be built to collect extremely sensitive information from an infected device.
Depending on the attack, that can include:
- Reading messages, emails, files, and contact information
- Tracking location and movement patterns
- Collecting call records and account data
- Capturing passwords, browser sessions, or authentication cookies
- Activating sensors such as the microphone or camera in some circumstances
- Monitoring who a person communicates with and when
A phone or laptop contains a detailed record of daily life. That is why spyware is so invasive. It can expose both private information and the people around the target.
If you want a clearer overview of this broader threat, read my guide to phone spyware and how to protect yourself.
The deeper problem is the advertising ecosystem
The biggest lesson here is not that every ad network is intentionally serving spyware. The problem is that the digital advertising ecosystem moves huge amounts of targeting data and executable ad code across websites and apps at enormous scale.
That combination creates risk:
- Ad auctions make it possible to reach very specific devices.
- Device identifiers and tracking data make it easier to profile potential targets.
- Advertising code can be complex and is often loaded from outside the website a person intended to visit.
- Ads appear inside many mobile apps, where a browser extension may not protect you.
This is why I see ad blocking as both a privacy tool and a security control. It reduces tracking noise, lowers exposure to unwanted third-party code, and makes the attack surface smaller.
Practical steps I recommend
No single setting can eliminate targeted spyware risk, but a layered approach makes opportunistic attacks harder and helps reduce exposure.
1. Install updates quickly
Keep your phone, computer, browser, and apps updated. Zero-click attacks depend on vulnerabilities, so security patches are one of the strongest everyday defenses.
Turn on automatic updates where possible. Do not keep an old phone or computer as your main device after it stops receiving security fixes.
2. Block ads and trackers where you can
Use a reputable content blocker in your browser. A DNS filter can also block many known advertising and tracking domains across your home network.
I recommend thinking of this as one layer, not a guarantee. Browser blockers do not cover every ad shown inside every mobile app, and an attacker may use other delivery methods. But blocking unnecessary ads still reduces exposure.
3. Reduce ad personalization and unnecessary identifiers
Review the privacy settings on your phone and major apps. Limit ad personalization, reset or restrict advertising identifiers where your platform supports it, and remove apps you no longer use.
Every identifier and permission you leave active can create more tracking data. You cannot remove all of it, but you can stop giving it away without a reason.
4. Be selective with apps and permissions
Install apps from reputable stores, remove abandoned apps, and review permissions regularly. A weather app, flashlight app, or casual game should not need permanent access to your microphone, precise location, contacts, or camera unless there is a clear feature that requires it.
Fewer apps and fewer permissions mean fewer places for sensitive data to leak.
5. Use stronger protections if you may be targeted
People at higher risk should consider additional protections, including dedicated devices for sensitive work, a well-maintained password manager, strong multi-factor authentication, and specialist high-risk device protections.
Apple Lockdown Mode is one example of a feature designed to reduce exposure to sophisticated targeted attacks, although it can limit normal device features. I explain its benefits and limits in my article on Cellebrite, phone forensics, and Lockdown Mode.
Need help improving your privacy setup?
If you want ad blocking, DNS filtering, safer browser settings, or a more private home network but do not want to sort through every option alone, I can help set it up properly. Reach out through the contact page and let us talk about your setup.
Related posts
- How to Reduce Tracking Online Without Breaking Everything
- Phone Spyware: How It Works and How to Protect Yourself
- What Is Cellebrite? Phone Forensics and Lockdown Mode Explained
Frequently asked questions
Can I get spyware just by seeing an online ad?
In a documented zero-click attack, an ad can be part of the delivery path without the victim clicking it. However, successful infection requires a capable attacker and a vulnerability that works against the target device. This is a serious targeted threat, not proof that every ad infects every device.
Does an ad blocker fully protect me from AdFection?
No. An ad blocker can reduce exposure to advertising code and tracking, which is valuable, but it is not complete protection. Some ads appear inside mobile apps, and sophisticated attackers may use different methods. Keep your software updated and use multiple layers of protection.
Should I delete all apps that show ads?
You do not need to delete every ad-supported app. I recommend removing apps you do not use, avoiding unknown publishers, keeping the apps you keep updated, and reviewing permissions. If an app seems invasive or unreliable, replace it with a more trustworthy alternative.
Who is most at risk from zero-click spyware?
Targeted spyware is most often associated with people whose work, role, contacts, or location makes them valuable surveillance targets. That can include journalists, activists, government employees, researchers, executives, and people working on sensitive issues. Everyone else should still follow the same security basics because they protect against much more common threats too.