What if you simply viewed an ad and your device got infected?

The Straits Times, What if you simply viewed an ad and your device got infected?

By Dr Victor Keong, Information Systems Technology and Design

Zero-click spyware exposes the limits of cybersecurity training and puts the onus on employers to stop intrusions.

Time and again, we are reminded: Don’t click on a suspicious link. But what if spyware can be delivered to us through an online advertisement, without any action on our part?

On Oct 15, researchers at the University of Toronto’s Citizen Lab and Confiant, a New York-based advertising security firm, reported exactly such a finding. They said that an Israeli advertising company, Discover-Tech, had given spyware makers, including Candiru, access to advertising networks run by Google, Comcast and Yandex. Between March and June alone, Discover-Tech’s advertisements appeared on about 75,000 apps and 120,000 websites.

The identifiers of the targets – such as a phone’s advertising ID, a browser cookie or an IP address – had been provided. When one of Discover-Tech’s advertisements loaded, it checked who was viewing it. If the viewer was one of the selected targets, their device details were sent to the spyware maker’s servers, which then infected the device. At Al Jazeera, at least 45 devices were targeted between 2024 and 2025. The spyware recovered by the researchers was built for Windows computers. The same system also tracked millions of phones.

This brings us to the root of the problem. The people who build spyware have often learnt their skills in the same places as those who build firewalls. This means an engineer who discovers a flaw in widely used software can report it to the vendor so that it can be fixed or sell it to a spyware maker so that it can be exploited. The Discover-Tech case shows that spyware buyers – whether intelligence agencies or cybercriminals – now have a new delivery channel for stalking their targets: the commercial advertising system that funds much of the internet.

The finding raises a difficult question for every organisation that requires staff or students to complete annual cybersecurity training. If an attacker can infect a device without its owner clicking on anything, organisations need to reconsider what the training achieves and where their security budgets should go.

Limits of awareness training
Awareness training remains necessary. Most fraud and account theft affecting ordinary people still begins with someone clicking a link, paying a fraudulent invoice or disclosing a one-time password, and training helps reduce those losses.

Problems arise when organisations treat training results as proof of security. A phishing simulation measures whether employees can identify a fraudulent e-mail. It does not measure whether the organisation’s computers and phones are patched, whether its security team would detect a compromised device, or how quickly it could contain an intrusion. No employee can detect a zero-click attack, so the people who build, configure and operate an organisation’s technology must be responsible for stopping it.

Employers and schools should narrow awareness training to the scams people encounter most often, such as impersonation calls, invoice fraud and requests for one-time passwords, and spend the time and budget saved on testing their own defences.

Three questions matter most. How many days does the organisation take to install a critical security update on every staff computer and phone? Can its IT team detect a compromised work device and isolate it remotely? If an intruder is already inside the network, can its security team find and remove that intruder within hours? The answers reveal whether the organisation can withstand an attack that no employee could have stopped.

Responsibility must move upstream
Users cannot repair a flaw in their browser or operating system, or vet the advertisers bidding for space on their screens. The companies that can do so should bear that responsibility.

Advertising platforms should act first, because Discover-Tech used them to reach its targets. Google and several other platforms cut off Discover-Tech after the findings were published, but none detected the abuse on their own. Banks must verify their customers before handling their money; advertising exchanges that sell access to millions of devices should verify their advertisers and inspect what their advertisements load. App developers who embed third-party advertising code without examining it share responsibility for what that code does. Software makers and phone manufacturers should shorten the time it takes for security updates to reach users and make those updates harder to defer.

The good news is that zero-click spyware is expensive, so operators reserve it for selected targets such as journalists, lawyers, senior executives, activists and negotiators. But what was troubling for most people was that Discover-Tech’s advertisements collected identifying information from millions of devices, which was a serious privacy breach even when no spyware followed.

Ordinary users face two risks. The first is fraud and account takeover, against which the established advice remains effective: verify requests before acting, enable two-factor authentication and never disclose one-time passwords. The second is commercial profiling, because every advertisement a device loads can report the user’s identity and location to the advertiser, which may sell that data.

Five measures can make computers and phones harder to track and compromise.

First, install software and browser updates promptly, because zero-click attacks exploit flaws that updates fix. Second, restart devices regularly, because many spyware tools do not survive a restart. Third, disable the phone’s advertising identifier and use a browser that blocks advertisements and trackers, because this limits the data advertisers can collect. Fourth, remove unused apps, because each one carries its own advertising code. Finally, those whose work makes them likely targets should enable Apple’s Lockdown Mode or Android’s Advanced Protection, because these settings disable features that spyware most often exploits, such as message attachments and complex web content.

These measures will not stop a well-funded and determined attacker, but they make an ordinary user more expensive to attack and therefore a less attractive target.

The engineers who built Discover-Tech’s platform were highly capable, and so were the researchers at Citizen Lab and Confiant who exposed it. One group used those skills to break into people’s devices, the other to expose the intrusions.

For two decades, the cybersecurity industry has described users as the weakest link. The industry and the technology companies it serves must now hold themselves to the same standard and build systems that protect people even when they do everything right.

• Victor Keong is an associate professor of practice with the Information Systems Technology and Design pillar at the Singapore University of Technology and Design.