Mercenary Spyware Hides in Everyday Online Ads, Study Finds

A new investigation by the Citizen Lab at the University of Toronto reveals that seemingly innocuous online advertisements can serve as covert entry points for sophisticated spyware, a technique the researchers have labeled “AdFection.” The findings suggest that users may become infected simply by loading a page that displays a targeted ad, without having to click on anything.

The lab’s report, released on Thursday, documents several real‑world examples, including ads for earbuds, consumer drones and a bubble‑gum‑scented car air freshener. In each case, the ad payload exploited vulnerabilities in browsers or underlying operating systems, allowing malicious code to install on the device silently. The researchers traced the malicious code back to a commercial ad‑tech supply chain that appears to be used by multiple actors.

Experts describe the software as “mercenary spyware,” meaning it is marketed to governments or other clients who seek to monitor or exfiltrate data from targets. Unlike nation‑state tools that are often bespoke, this spyware is packaged for resale, making it accessible to a broader range of surveillance campaigns. Similar approaches have been observed in past supply‑chain attacks, but the “no‑click” delivery vector marks a notable escalation.

The discovery raises concerns for everyday internet users as well as for the digital advertising ecosystem. Advertisers rely on third‑party networks to reach audiences, but the lack of rigorous security checks can allow malicious actors to piggyback on legitimate campaigns. Security professionals warn that traditional defenses, such as antivirus scanners, may miss these threats because the infection occurs before any user interaction.

Citizen Lab says it will continue to monitor the phenomenon and urges platform operators, regulators, and ad‑tech providers to implement stricter vetting and transparency measures. The lab’s report adds pressure on policymakers to consider new standards for ad supply‑chain security, aiming to protect the privacy of billions of users who encounter online ads daily.