[Contribution from a young software engineer, Adelaide]
Most internet users have learned to regard suspicious advertisements as potential security threats. The conventional advice is familiar: do not click on dubious links, avoid unexpected downloads, and never enter personal information into unfamiliar websites. Unfortunately, a disturbing new investigation suggests that these precautions, while still valuable, are no longer sufficient against some of the most sophisticated forms of cyberattack. Researchers have uncovered an operation in which online advertisements were allegedly exploited to identify and compromise computers and smartphones without requiring victims to click anything at all. The danger lies not merely in malicious advertisements, but in the extraordinary surveillance and targeting infrastructure that has developed around the modern advertising industry.
The revelations emerged on 15 October 2026, when researchers from the University of Toronto's Citizen Lab and the American advertising-security company Confiant disclosed an operation known as AdFection. Their investigation concerned Discover-Tech, an Israeli advertising-technology company alleged to have exploited digital advertising networks for surveillance and spyware delivery. According to reporting by Reuters and the Financial Times, the operation involved advertising infrastructure reaching more than 120,000 websites and tens of thousands of applications. Researchers identified billions of advertising bids, while evidence linked the operation to spyware associated with Candiru, another Israeli company previously placed on a United States government blacklist.
The most alarming aspect was the reported ability to compromise selected devices without the ordinary user interaction associated with malicious downloads. Citizen Lab documented 45 compromised devices belonging to personnel associated with Al Jazeera, with infections occurring during 2024 and 2025. Other organisations, including NATO, European institutions and major technology companies, reportedly appeared among the targets of the advertising operation. These findings do not establish that every advertisement displayed to those organisations installed spyware, nor that every user exposed to the advertising infrastructure was infected. Nevertheless, they demonstrate that commercial advertising systems can be exploited for purposes far removed from selling products.
To understand the danger, it is necessary to examine how modern internet advertising operates. When someone opens a webpage, the advertisements displayed are often selected through automated auctions conducted in fractions of a second. Advertising companies compete for the opportunity to display material to particular users, drawing upon information about devices, browsing behaviour, geographical location and other characteristics. This process, known as real-time bidding, involves the rapid exchange of information among numerous commercial participants. Although designed primarily to maximise advertising revenue, it also creates opportunities for identifying and tracking individuals across websites.
The AdFection investigation illustrates how such infrastructure can become a surveillance mechanism. A malicious participant may exploit advertising data to locate particular devices, identify potential targets and arrange for advertising content to reach them. Under some circumstances, malicious code delivered through advertising systems may exploit vulnerabilities in browsers or operating systems. If successful, such an attack can compromise a device without requiring the victim to download a suspicious attachment or knowingly visit a criminal website.
Cybersecurity specialists refer to related attacks as drive-by compromises or malvertising. The concept is not entirely new. Criminals have long attempted to insert malicious advertisements into otherwise legitimate websites, exploiting the fact that advertising content is frequently supplied by third-party networks rather than by the website itself. A visitor may trust a familiar news organisation or commercial service while remaining unaware that some advertising content originates elsewhere. The website may be entirely legitimate, yet the advertising supply chain can introduce additional risks.
It is important, however, to distinguish between several different mechanisms. Some malicious advertisements merely redirect users towards fraudulent websites or attempt to persuade them to install dangerous software. Others exploit browser vulnerabilities or weaknesses in associated components. Still others use advertising networks primarily to identify targets before launching separate attacks. These techniques differ considerably in sophistication and effectiveness. The existence of zero-click spyware does not mean that every ordinary advertisement can automatically seize control of a fully updated computer. Successful compromise generally depends upon particular technical vulnerabilities, weaknesses in security controls or other exploitable conditions.
Nevertheless, the implications are troubling. The traditional distinction between actively engaging with dangerous material and merely encountering it becomes less reassuring when hostile code can be delivered through ordinary webpage loading. A person may visit a reputable news website, avoid clicking advertisements and still encounter potentially malicious advertising infrastructure. In a successful zero-click attack, the victim may receive no obvious warning that anything unusual has occurred. The absence of suspicious pop-ups or unexpected downloads is therefore not conclusive evidence that a device has remained secure.
The revelations raise an obvious question about browser choice. Google Chrome remains one of the world's most widely used browsers, while Brave has developed a reputation for stronger privacy protections. Both are based upon the Chromium browser engine, but their approaches to online advertising differ significantly. Chrome provides substantial security mechanisms, including sandboxing, site isolation, automatic updates and Google Safe Browsing. These protections are designed to limit the consequences of malicious websites and prevent known threats from reaching users. It would therefore be misleading to describe Chrome as an inherently insecure browser.
Brave, however, includes an additional protective feature that is especially relevant to malvertising. Its built-in Shields system blocks many third-party advertisements and tracking requests before they are loaded. This can reduce exposure to the advertising networks through which malicious content may be delivered. Rather than relying entirely upon detecting dangerous code after it arrives, Brave attempts to prevent substantial categories of advertising content from reaching the browser in the first place. From a security perspective, reducing exposure to potentially hostile material is a sensible strategy.
This does not make Brave immune to hacking. No browser can guarantee complete protection against unknown vulnerabilities, malicious extensions, compromised websites or sophisticated attacks exploiting weaknesses outside the browser itself. Brave also shares much of Chromium's underlying technology with Chrome, meaning that certain security vulnerabilities may affect both products. Furthermore, blocking advertising does not eliminate every possible attack route. Malicious code may be delivered through compromised website content, software downloads, browser extensions or other mechanisms unrelated to advertising.
Nevertheless, Brave's approach illustrates an important principle of computer security: reducing the attack surface. Every external script, advertisement, tracker or unnecessary software component creates another potential interaction with material supplied by parties outside the user's immediate control. Blocking such content cannot eliminate risk, but it can reduce the number of opportunities available to attackers. This is particularly valuable when the advertising ecosystem involves complicated relationships among numerous companies whose security practices may vary considerably.
The Australian Signals Directorate has recognised the importance of blocking online advertisements as a cybersecurity measure. Its Essential Eight guidance identifies malicious advertising as a potential means of compromising computer systems and recommends preventing browsers from processing internet advertisements through appropriate blocking technologies. This advice is significant because it treats advertising not merely as a privacy nuisance but as a genuine security concern. The familiar irritation of intrusive advertisements is therefore connected to a much more serious issue: unnecessary exposure to potentially hostile code.
Chrome users are not without alternatives. Advertising-blocking extensions and network-level filtering can provide additional protection, although the effectiveness of particular extensions depends upon browser policies and technical capabilities. Google's changes to its browser extension architecture have generated controversy because they affect how some content-blocking tools operate. Brave's integrated Shields system is less dependent upon those extension mechanisms, giving it a practical advantage for users who want advertising and tracker blocking without installing additional software.
There is, however, a broader problem that cannot be solved simply by changing browsers. The AdFection investigation exposes the enormous amount of information circulating through the commercial advertising system. Real-time bidding can distribute details about users and devices among multiple participants, creating opportunities for tracking that extend beyond the original purpose of displaying advertisements. Even where no malware is involved, this infrastructure raises questions about privacy, informed consent and the extent to which ordinary internet activity has become a source of commercially valuable surveillance data.
The relationship between advertising and surveillance is especially troubling because most users have little understanding of the systems operating behind the webpages they visit. Someone reading a newspaper article may imagine that the transaction involves only the reader and the publisher. In reality, numerous advertising and analytics services may participate in the loading of a single page. These services can collect information, exchange identifiers and attempt to build profiles of users across different websites. The AdFection case demonstrates how infrastructure created for commercial targeting can potentially be repurposed for much more intrusive objectives.
The alleged involvement of commercial spyware companies adds another dimension. Sophisticated surveillance technologies are no longer confined to the intelligence agencies of major states. Private companies can develop or supply capabilities that enable customers to monitor individuals, extract information and potentially compromise personal devices. Such tools may be marketed for national security or law-enforcement purposes, but their existence raises serious concerns about misuse against journalists, political opponents, activists and ordinary citizens. The history of commercial spyware demonstrates that surveillance capabilities can be deployed in circumstances far removed from legitimate criminal investigations.
The economic structure of the internet also deserves scrutiny. Many websites depend upon advertising revenue to finance journalism, entertainment and information services. Blocking advertisements can reduce that revenue, potentially weakening the financial foundations of independent publishing. This is a genuine difficulty rather than an argument to be dismissed. Yet publishers and advertising companies cannot reasonably expect users to accept avoidable security risks simply to preserve existing commercial arrangements. If the advertising industry wishes to retain public confidence, it must demonstrate that its infrastructure can protect users against malicious exploitation.
There is a wider lesson about the technological complexity of modern life. Ordinary computer users are increasingly dependent upon systems whose internal operation they cannot realistically inspect. They must trust browser developers, operating-system vendors, advertising networks, cybersecurity providers and numerous other intermediaries. Each may possess considerable technical expertise, yet the interaction of these systems can produce vulnerabilities that no individual participant fully controls. The result is a digital environment in which personal security depends upon decisions made by distant institutions with differing commercial and organisational incentives.
For practical purposes, several precautions remain essential. Operating systems and browsers should be kept updated because security patches close known vulnerabilities. Unnecessary browser extensions should be removed, while software should be obtained from reputable sources. Advertising and tracker blocking can reduce exposure to malicious advertising networks. Users should also maintain reliable backups and avoid dismissing browser security warnings. None of these measures guarantees immunity from sophisticated spyware, but together they substantially improve protection against many common threats.
The distinction between Chrome and Brave should therefore be understood realistically. Chrome possesses strong underlying security mechanisms, but its normal operation permits substantial advertising activity unless additional blocking measures are employed. Brave blocks many advertisements and trackers by default, reducing exposure to one important category of threats. For users concerned about malicious advertising, this is a meaningful advantage. Yet anyone claiming that Brave is completely immune to zero-click attacks is offering reassurance that no responsible cybersecurity expert could guarantee.
The AdFection revelations also suggest that cybersecurity policy should look beyond the behaviour of individual users. Advising people not to click suspicious links remains useful, but it is inadequate when sophisticated attackers can exploit infrastructure that operates automatically in the background. Advertising companies, browser developers, publishers and regulators must confront the risks created by complex advertising supply chains. Security should not depend entirely upon the ability of ordinary citizens to recognise threats that may be technically invisible to them.
The most disturbing conclusion is that the commercial machinery designed to sell products has developed capabilities that can also assist in identifying, tracking and compromising individuals. An advertisement is no longer necessarily a harmless image inviting someone to purchase a product. It may be part of a complicated technological process involving surveillance data, automated auctions, executable content and numerous third-party intermediaries. When that infrastructure is exploited by sophisticated attackers, the consequences can extend far beyond unwanted marketing.
The old internet security advice was to be careful what one clicked. The new lesson is that even what one merely loads may matter. Brave's advertising protections offer a useful additional defence, but the deeper problem is an online economy that has normalised the extensive monitoring of users and the automatic delivery of third-party content. Until those practices are made substantially safer, ordinary internet users have good reason to regard the advertising industry not merely as an annoyance, but as a potential threat to their privacy and security.
https://www.youtube.com/watch?v=r4faygDPHgU