- How AdFection uses the display of an ad as the starting point
- Why ad exposure, an attack attempt and an actual infection are different things
- How to combine updates, limits on ads and tracking, and DNS filtering
The short answer
"Don't click suspicious links." Many people keep this rule in mind to stay safe online. But some attacks do not need the user to click anything at all.
On 15 October 2026, Citizen Lab, a research lab at the University of Toronto, published an investigation into "AdFection", a technique that infects devices with spyware through targeted online ads. It reports that the systems used to display ads were abused in the attack, and that an Al Jazeera device was infected; it attributes the spyware to Candiru with high confidence.
For everyday protection, combine keeping your operating system and browser up to date with reducing your exposure to ads and tracking.
How an AdFection attack works
Online ads can contain more than images and video: they often include small programs, for example to measure whether the ad was shown. AdFection abuses this delivery route to send attack code to selected devices. If a vulnerability on the device is exploited, infection can follow without the ad ever being clicked.
That said, seeing an ad does not mean you have been infected. Citizen Lab reports a mechanism that picks which devices receive the attack based on information such as IP addresses and advertising identifiers. Exposure to an ad, an attempted attack and an actual infection need to be treated as separate things.
Seeing an ad, an attempted attack and an actual infection are separate things. Displaying an ad does not mean infection.
No single step stops everything. Build layers on top of updates.
Why ads on legitimate sites still deserve attention
The sites and apps you use every day also receive ads through outside companies. Trusting a site does not tell you whether every party involved in delivering its ads is safe.
A report published the same day by the security company Confiant analyses how ad technology can be misused to identify devices, collect information and deliver code to selected targets. It shows that tracking through ads and attacks that exploit vulnerabilities can be connected. Even so, the fact that tracking took place is not enough to conclude that a device was infected with spyware. Confiant itself says it did not capture a complete attack chain.
Defences to review today
Check that your OS and browser are up to date
Start by checking whether an update is waiting to be applied. Even with automatic updates turned on, a restart may be needed before the update takes effect. In Chrome on a computer, for example, open the menu at the top right, go to Help, then About Google Chrome to check for updates, and relaunch when prompted.
Update your operating system and the apps you use regularly by following each vendor's official instructions. Updates fix known problems; they are not a guarantee against every attack, including those that use vulnerabilities nobody knows about yet.
Load fewer ads and trackers
Reviewing your browser's ad and tracking protection is another way to reduce the routes an attack can take. Citizen Lab also lists ad blocking and tracking prevention among its recommendations.
When you add a blocker, check that it comes from the official source and look at the permissions it asks for. If a work site stops working properly, adjust the settings for that specific site rather than widening exceptions more than necessary.
Use DNS filtering as an extra layer
DNS is the system that looks up where to connect from a site's name. A service that blocks lookups for ad and tracking domains can stop some connections to those domains. AdGuard DNS, for example, offers public DNS servers that block ads and trackers. Other services offer similar features. APOUL has no partnership or financial relationship with its provider.
DNS settings alone cannot protect all of your traffic, however. Confiant also reports code that looks up its destination over encrypted DNS and then connects directly to the IP address. Treat DNS filtering as a layer added on top of device updates and your other defences.
If you change your DNS settings, check the provider's policies and your company's network rules first, and make sure you can switch back if something goes wrong.
Consider extra protection if you face targeted attacks
If your reporting or other work could make you a target of sophisticated attacks, consider seeking expert advice, and look at Lockdown Mode on Apple devices. It reduces what can be attacked by restricting some app and web features, which also affects everyday use. Check the requirements and restrictions before deciding.
Organisations should prepare for detection and recovery
For organisations, what APOUL considers important is being able to investigate connections together: matching the destinations of network traffic, and linking them to suspicious program behaviour and to settings changed so that something keeps running after a restart.
At the same time, false alarms should not bring work to a halt. What was the basis for the alert? How far does the block reach? How do you lift it? We recommend keeping a record of these decisions and actions, so that you are always in a position to recover.
This article is based on information publicly available as of 19 October 2026. Settings and available features vary by OS and app version.
Checklist
- No OS or browser update is sitting unapplied while waiting for a restart
- The apps you use regularly are updated through each vendor's official instructions
- You have reviewed your browser's ad and tracking protection, without overly broad exceptions
- Before changing DNS, you check the provider's policies and company rules, and note how to switch back
- In your organisation, the basis for each alert, the scope of each block and how to lift it are recorded
One thing to check today
Check whether your devices' OS and browser are up to date, and review your settings for ads and tracking.