Ordinary online ads can be used to steal passwords, track users, and infect devices with spyware. Cybersecurity researchers have discovered that, in some cases, attackers don’t even need users to click on an ad. Simply displaying it on their screen can be enough.
Researchers at the University of Toronto’s Citizen Lab uncovered the AdFection campaign, in which Israeli company Discover-Tech allegedly helped spyware operators distribute malicious code through advertising networks. Between 2024 and 2025, the attacks targeted at least 45 devices belonging to Al Jazeera employees, and researchers confirmed infections involving spyware linked to Candiru.
After analyzing nearly 4 billion advertising auction records, researchers found that Discover-Tech ads appeared on more than 120,000 websites and in 70,000 mobile apps during just four months of 2026. However, the appearance of these ads did not mean that every user was automatically infected. Instead, the findings demonstrated how extensively attackers could exploit ordinary advertising infrastructure.
For most users, the greatest threat is not expensive spyware typically deployed against journalists and politicians, but fraudulent ads disguised as promotions from well-known companies. Attackers pay to place these ads above regular search results, impersonating banks, software developers, and other popular services.
In April 2025, the FBI warned about scammers creating fake employee payroll management websites. Clicking on a sponsored link redirected users to a phishing copy of a legitimate service. Once victims entered their login credentials, attackers could steal personal information and redirect salary payments to their own accounts.
Another common method involves advertising fake software and fraudulent browser updates, tricking users into installing malware themselves. The scale of the problem is highlighted in Google’s report: during 2025, the company blocked or removed 8.3 billion ads for policy violations, including 602 million linked to scams. Google also suspended 24.9 million advertiser accounts.
However, these figures cover various policy violations, not just ads containing malicious code. According to Google, more than 99% of ads that violated its policies were stopped before users ever saw them.
The dangers of online advertising extend beyond malware infections. Advertising networks also collect information about users’ devices, browsing histories, and locations. The UK’s Information Commissioner’s Office (ICO) emphasizes that tracking individuals for personalized advertising requires their consent, while the amount of data collected is often excessive.
In October 2026, Norway fined Microsoft-owned advertising company Xandr 92 million Norwegian kroner. The penalty was related to the sharing of sensitive Grindr user data with thousands of advertisers between 2018 and 2020, before Microsoft acquired the company.
Despite these risks, most online ads remain safe, and advertising helps fund free online services. Following the publication of Citizen Lab’s investigation, Google and several other advertising companies ended their relationships with Discover-Tech. However, there is still a window between the appearance of malicious ads and their removal during which users may be exposed to threats.
Security experts recommend visiting company websites directly instead of clicking sponsored search results, regularly updating browsers and operating systems, and considering the use of ad blockers. Even an ordinary-looking advertisement can conceal a threat that users may not recognize at first glance.
