This week, researchers at the University of Toronto’s Citizen Lab published something security people have worried about for years: proof that an ordinary online ad can install spyware on a phone without anyone clicking anything. The ad simply has to appear on the screen. They call the technique “AdFection,” and they say it is the first public confirmation of this kind of zero-click attack being delivered through targeted advertising.
Most small businesses in the south suburbs are not on any government’s target list. But the system this attack rode in on, the ad network that decides which ad shows up in which app on which phone, is the same one running on every phone and laptop in your office right now. So we looked at what that system is doing on our own network in Markham, and the numbers are worth sharing.
What the researchers found
According to Citizen Lab’s report, an Israel-based company called Discover-Tech presented itself as an advertising firm. In reality, the researchers say, it was a bridge between the ad industry and companies that sell spyware to governments. Its ads ran in apps and on websites most of us use without a second thought: Duolingo, weather apps, dating apps, period trackers, Yahoo Mail, Viber, and Truecaller, plus sites like the BBC, the New York Times, AccuWeather, and Fox News. Reporting on the study puts the total at about 442 million ads on more than 120,000 websites and apps.
Here is how it worked. When one of these ads appeared, the device’s advertising ID and IP address went to Discover-Tech’s servers. That let the company build profiles and figure out who was behind a given phone. If a person was picked as a target, the device was later sent malicious code that exploited a flaw and installed spyware. The ad itself looked harmless, which is how it got past the ad platforms’ checks. Citizen Lab says with high confidence that devices at the news network Al Jazeera were infected this way. Google has since banned Discover-Tech from its ad platforms.
Citizen Lab senior researcher Bill Marczak’s advice to anyone who might be a target: “it’s time to disable ad tracking on your devices or even block ads altogether.”
Why a small business should care
Mercenary spyware is expensive and aimed at specific people. The bigger lesson for a 10-person office is simpler: the ad system lets almost anyone pay to run code on your employees’ screens and collect information about your network. This time it was a spyware broker. More often it is ordinary criminals buying ads that copy real brands, such as a fake download page for remote-access software or a fake bank login sitting at the top of the search results.
Every ad that loads on your office Wi-Fi also tells the ad network your office’s public IP address. That is how an ad company can tell that a particular phone sits inside a particular business.
What one day of ads looks like on our own network
Our Markham office runs a filtering DNS server. Every device on the network, including the phones on our Wi-Fi, asks it where to find each website or service, and it refuses to answer for known ad, tracking, and malware domains. Here is what it reported for the last 24 hours as we wrote this:
- 53,420 lookups from 35 active devices
- 4,313 of them blocked, about 1 in every 12
- About 1.1 million domains on the block list, most of them from malware lists
The most-blocked names are the interesting part. Next to the usual Microsoft, Mozilla, and Adobe telemetry, the list is full of the ad networks built into free mobile apps and games: AppLovin, Vungle, InMobi, and Unity’s ad mediation service. That is in-app advertising, the same kind of inventory Citizen Lab says Discover-Tech preferred. To be clear, those are legitimate companies and nobody is accusing them of anything. The point is how much ad traffic runs on an office network without anyone noticing, and that every one of those requests is a chance for someone else’s code to reach your device.
What we’d do in your office
1. Filter ads and trackers on the network. A filtering DNS server, or a firewall with the same feature, protects every device on your Wi-Fi at once, including phones, smart TVs, and anything you can’t install software on. It isn’t perfect: it only works while a device is on your network, and an ad served from the same domain as the content can’t be blocked this way. Still, it removes a lot of risk for very little effort.
2. Turn off ad tracking on company phones. On an iPhone, go to Settings, then Privacy & Security. Under Tracking, turn off “Allow Apps to Request to Track,” and under Apple Advertising, turn off Personalized Ads. On Android, open Settings and look for Privacy, then Ads, then “Delete advertising ID” (the exact path varies by phone maker). This doesn’t remove the ads, but it takes away the ID that lets someone follow a specific phone from app to app.
3. Keep phones and browsers updated, and restart them. Zero-click attacks depend on software bugs that haven’t been patched yet. Turn on automatic updates, and have people restart their phones and computers at least once a week so the updates actually install.
4. Never download software or log in to a bank from an ad. Type the address or use a bookmark. Scammers buy ads for exactly the searches your staff make every day.
5. Give your highest-risk people extra protection. If someone in your business could realistically be singled out, such as the person who approves wire transfers or anyone handling sensitive legal work, turn on Apple’s Lockdown Mode on their iPhone. It turns off many of the features these attacks rely on, at some cost in convenience.
Want this set up for your office?
Digitech installs and manages network-level ad and malware filtering for small businesses across the south suburbs. It’s the same setup we run in our own office, and we tune it so the block list stops the junk without breaking the tools your staff actually use. To find out what your network is talking to, call us at 708-596-2990 or email mknipper@digitech815.com.
Sources: Citizen Lab, “Exposing AdFection” (October 2026); Engadget and The Guardian coverage of the report.