For years the advice has been simple: don't click the suspicious link. Don't open the strange attachment. Don't tap the ad that looks too good to be true.
This week, researchers showed that some attackers no longer need you to do anything at all. The ad loads on your screen while you read the news or play a game, and that alone can be enough to infect your phone with spyware. Security people call this a "zero-click" attack, and this one arrived through the same advertising system that puts ads in nearly every free app and website you use.
What the Researchers Found
The finding comes from the Citizen Lab, a research group at the University of Toronto with a long record of exposing commercial spyware. Their report, which they named "AdFection," describes an Israeli company called Discover-Tech that presented itself as an ordinary advertising business. According to the researchers, it was quietly helping several spyware makers, including one called Candiru, deliver their tools to chosen targets.
The confirmed victims were journalists. At least 45 devices belonging to people at the news network Al Jazeera were targeted in 2024 and 2025. The ads themselves ran far more widely: between March and June of this year, Discover-Tech's ads appeared on more than 120,000 websites and over 70,000 mobile apps. Google has since cut the company off from its advertising platforms.
How an Ad Can Infect a Phone
Most people think of an ad as a picture someone paid to put on a page. Behind the scenes it works more like an auction that happens in a fraction of a second.
When you open a free app or website, your phone shares a few things about itself with the ad networks: roughly where you are, what kind of device you have, and an advertising ID, a tracking number built into your phone so advertisers can recognize you across different apps. Advertisers bid to show you an ad, the winner's ad appears, and you never notice any of it.
In this scheme, the ad carried a small piece of code that reported your advertising ID back to the attackers' server. The server then decided whether you were the person they were after. For almost everyone, the answer was no, and nothing else happened. For the chosen target, the server sent back code that ran automatically and began the infection. No click, no download, no warning sign to notice.
Should You Worry?
Most people reading this will never be a target. Mercenary spyware is expensive and aimed at specific people, usually journalists, activists, government officials, and people with money, influence, or sensitive information worth spying on.
Two things are still worth knowing. First, the researchers found that people who were not targeted still had their device details collected and sent to the ad company simply by seeing the ads. Second, techniques invented for high-value targets tend to get cheaper and spread to everyday criminals over time. The ad system that delivered this attack is the same one running inside the free apps on your phone right now.
Five Settings That Make Your Phone a Harder Target
The good news: the Citizen Lab's own report points out that blocking advertising identifiers directly breaks the method used here. These steps take a few minutes and cost nothing.
- Turn off ad tracking. On an iPhone, go to Settings, then Privacy & Security, then Tracking, and turn off "Allow Apps to Request to Track." On Android, open Settings and look for Ads (usually under Privacy or Google), then choose "Delete advertising ID."
- Turn on automatic updates. Attacks like this rely on flaws in your phone's software, and updates are how those flaws get closed. Let your phone install them on its own, and don't put off the restart.
- Restart your phone once a week. The National Security Agency recommends this in its own phone-security guidance, because some spyware lives only in memory and does not survive a restart.
- Cut down on free, ad-heavy apps. Every free game and flashlight app that shows ads is another doorway into that ad auction. Delete the ones you no longer use.
- Block ads in your browser. A reputable ad blocker, or a browser that blocks trackers by default, keeps many of these ads from loading in the first place.
If you have reason to believe you are a likely target, because of your work, your public profile, or your wealth, go one step further. Apple's Lockdown Mode and Android's Advanced Protection are built-in settings designed for people facing exactly this kind of spyware. They switch off some conveniences in exchange for a much smaller target.
You Should Not Have to Handle This Alone
The hardest part of a zero-click attack is that there is nothing for you to spot. You cannot out-think an ad you never touched. Protection comes down to the right settings, current software, and someone keeping an eye on your devices for you.
That is the idea behind Digital Bodyguard. We set up protection on your computers, phones and tablets in person, and from then on your computers are kept up to date and protected. The protection app on your phone checks the links that reach you, flags harmful apps, and reports to us as well as to you, so a warning you missed still gets looked at by a person. And when a headline like this one makes you wonder whether your phone is set up right, you have a local cyber analyst to ask.
No tool can promise to stop every attack. What you can do is close the easy doors, keep your software current, and stop being the only person in your household who has to figure all of this out.