No click. No download. No suspicious link. Just an ad, loading on a screen.
That was enough. Researchers at Citizen Lab revealed a malware campaign dubbed “AdFection,” the Electronic Frontier Foundation reported on 26 October 2026. According to the EFF, it “used an ad network to distribute spyware” to journalists’ devices “without the target ever needing to click anything.”
The target did NOTHING. The ad did the rest.
The EFF called it “a noteworthy first-of-its-kind.” Malvertising is not new. Zero-click attacks are not new. “What’s novel about the AdFection attack is combining them,” the EFF wrote.
How An Ad Became The Weapon
The EFF walked through the infection as Citizen Lab described it, using a Windows device that Al Jazeera supplied to the researchers.
First, someone on that machine is served an ad created by Discover-Tech. Citizen Lab’s report, as quoted by the EFF, describes the company as “purporting to be a legitimate advertising company, [but] appears to be a front for large-scale ad espionage abuse.”
The ad carries a small snippet of JavaScript that runs automatically. It reaches back to a Discover-Tech server, which the EFF says is called the “NOAS server,” with details about the machine: “its cookie-set advertising ID, IP address, and more.”
The server uses that information to determine it is an Al Jazeera machine. Then, the EFF wrote, “Instead of returning an empty response (as it does most of the time), it responds with a malicious, zero-click spyware payload.”
According to the EFF, that payload was created by Discover-Tech’s partner Candiru/Integrity Labs, which it called “a company previously exposed for involvement in sophisticated malware attacks.”
The same tracking data that picks your ads was used to pick who got infected.
The Ad Machine Is The Delivery Truck
Here is the part that should keep you up at night. The EFF said this attack “was enabled by the everyday practices of ad-tech companies,” which “have extreme latitude in the collection of users’ data.”
Most ads move through Real-Time Bidding auctions. And per the EFF, “winning bidders are given the ability to execute JavaScript code in the browser of the person who receives the targeted ad.”
A tracking ID built to sell you things. Repurposed to fine-tune a spyware hit list. What else is that data good for?
The EFF wants behavioral ads banned altogether. Its verdict: “They are the perfect vehicle for malvertising and similar threats, just as we see here.”
Lock Down Your Devices Now
Citizen Lab and the EFF list steps anyone can take. Per the EFF, use a browser extension to reduce tracking, such as Privacy Badger, consider network-wide ad blocking, consider more privacy protective browsers, and on phones, “disable or reset your AD ID.”
On Android, the EFF’s Surveillance Self-Defense guide (last reviewed 23 June 2025, written for Android 16) says the ad identifier “enables most third-party tracking on mobile devices.” The fix: “Open Settings > Security & privacy > Privacy controls > Ads, and tap ‘Delete advertising ID.’”
The EFF describes Surveillance Self-Defense as “a digital security guide that teaches you how to assess your personal risk from online spying.” It suggests starting with its “Your Security Plan” guide.
Every tracker you kill is one less handle for the surveillance state’s toolbox. Kill them.
Keep Your Keys Off Their Grid
This is not a Monero story. It is a story about how much your devices give away without asking you.
Your money deserves the same lockdown. A self-custody wallet keeps your keys on your own device, not with an exchange. Monero One is a free, open-source, self-custody Monero wallet for iPhone and Android. Your keys stay on your device. The app sends us no analytics. Full disclosure: the host built Monero One. He’s biased. He’s also right.
Want to go further? Read this guide to remote node privacy.
Follow @MoneroOne on X and join the Resistance on Telegram (t.me/monero_one).
SOURCES
- the EFF: Lessons Learned From ‘AdFection’ and What To Do Next
- ssd.eff.org: Basics, Surveillance Self-Defense
- ssd.eff.org: How to: Get to Know Android Privacy and Security Settings
Join the resistance in style: get Monero One at no cost. It stays free.
Comments
Talk about this story with the resistance on Telegram.
Join the discussion