On Thursday, researchers from The Citizen Lab at the University of Toronto revealed a terrifying reality: spyware can silently infect your phone via ads, turning your daily browsing into a digital battleground.

This campaign, dubbed “AdFection,” is a stark reminder that ads, meant to be benign, can now be used to silently push malware onto devices. The Israeli advertising firm Discover-Tech seems to be the mastermind, with their ads linking to Candiru’s spyware, targeting 45 devices belonging to the news outlet Al Jazeera.

The risk is immense. Zero-click attacks, where malware is installed without any action from the user, are no longer the stuff of science fiction. Advertisers’ complex real-time bidding process, meant to optimize ad placement, has become a vector for cyber espionage. Blocking ads is the best defense, but that’s easier said than done.

The tech giants and industry bodies are taking notice. Google and the IAB have suspended Discover-Tech, sending a clear warning that such practices won’t be tolerated. Yet, the underlying infrastructure remains, and until it changes, the threat will persist.