An employee can encounter a spyware attack without clicking an advertisement. In its October 15, 2026 AdFection investigation, the University of Toronto's Citizen Lab documented targeted ads delivering zero-click mercenary spyware.
For businesses, the practical lesson is to protect the browsing session before a user has a decision to make. Reduce unnecessary advertising exposure, maintain browser and operating-system updates, restrict unauthorized software, and ensure suspicious activity reaches people equipped to investigate it.
What Citizen Lab established about AdFection
Citizen Lab linked attacks targeting at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware delivered through Discover-Tech advertisements, with high confidence. The report documents infections; the 45-device figure describes targeting and should not be presented as 45 confirmed infections.
The delivery sequence starts when an ad loads in a website or app, sometimes in the background. Embedded code contacts advertising infrastructure, which can select particular devices for further profiling and infection. No ad click is required. Most people shown these ads were not selected for a spyware payload.
That makes ad exposure, targeting, and confirmed compromise different findings. The research does not establish that ordinary advertisements are infecting every viewer or that every business is currently a target.
Our assessment is that this deserves a technical response without alarmist claims. A familiar website name is an incomplete basis for trusting every third-party resource a page loads. Awareness training remains useful, but recognizing suspicious links cannot be the only barrier when the attack needs no click.
Treat advertising exposure as a security policy decision
Malicious advertising is a longstanding security problem. The NSA's guidance on blocking unnecessary advertising content, published in 2018, recommends prompt software updates together with controls that block potentially malicious ads. It describes both network and device approaches, including the need to assess browser extensions and manage website compatibility.
Start by deciding which advertising and tracking traffic your organization actually needs. Apply a managed policy, test essential business workflows, and give employees a clear route to request exceptions. An exception should identify the business need and the content being allowed; restoring an entire advertising category because one page breaks can undo much of the protection.
Network Box USA's Managed Secure Web Gateway provides URL filtering, content policy, HTTPS inspection, malware scanning, and application control. Managed UTM+ adds gateway controls such as firewall policy, intrusion prevention, and malware inspection. These create opportunities to restrict risky destinations and inspect relevant traffic, according to the deployed design and enabled policies.
For an AdFection review, the useful question is whether advertising requests are actually covered by those policies. A service's ability to filter web traffic does not establish that ad blocking is enabled, that every advertising source is classified, or that every connection is inspected. Define the intended coverage and verify it.
Keep browser, operating-system, and application updates part of the same discussion. Patching addresses known weaknesses; it does not establish immunity to every undisclosed exploit. Likewise, an ad-blocking policy reduces exposure without proving that every possible delivery path has disappeared.
White Cloud Security: block software that is not trusted
White Cloud Security can operate in a mode where software that is not recognized as trusted is blocked from running. On covered Windows and Linux endpoints, its default-deny policy applies to applications, libraries, and scripts: without an approved trust decision, execution is denied.
This is the central value of White Cloud Security application control. It does not need to recognize an unknown file as a particular piece of malware before denying it. The decision is whether the software is trusted and authorized to execute. Unknown or unapproved software is blocked by default.
That creates an additional barrier in an attack delivered through an advertisement. Getting an unauthorized executable or library onto a protected device does not automatically give it permission to run. In enforcement mode, the component must satisfy the trust policy before execution is allowed. White Cloud's system documentation describes this default-deny model and its controls for applications, libraries, and scripts.
To put that protection into practice, confirm that blocking is enabled on the intended endpoints and manage software approvals deliberately. Broad trust exceptions can change what is allowed to run, so the approval process is part of the protection.
This complements the other layers: web controls reduce exposure, White Cloud restricts unauthorized execution, and monitoring supports investigation and response. Browser updates and web protection still matter; execution control alone is not proof that every exploit operating inside an already approved browser will be stopped.
Make suspicious activity investigable
Citizen Lab used network records to connect advertising infrastructure, device validation, and subsequent spyware command-and-control communications. That sequence illustrates why retaining relevant evidence matters.
For an organization reviewing its own readiness, ask whether analysts could connect a web event to the device involved and examine what happened afterward. Useful evidence may include DNS and web activity, outbound connections, endpoint process activity, and execution-policy decisions, where those records are available. Collection, retention, timestamps, and device identification need to support that investigation.
NBX Managed Detection and Response combines endpoint and cross-environment detection with investigation, threat hunting, and a 24/7 Security Operations Center. Network Box USA's managed SIEM capabilities, included with qualifying services, provide centralized visibility for supported, connected sources.
The service scope should identify which sources are connected, who reviews suspicious activity, and what response actions are authorized. A retained log is useful evidence; it does not mean every spyware technique will automatically generate an alert. An advertisement being logged also does not, on its own, establish an infection.
Check the laptop after it leaves the office
A gateway can only enforce policy on traffic that reaches it. Include home working, travel, mobile apps, and alternate network connections in the coverage review. An office policy may be working exactly as designed while a roaming device follows a different path.
Network Box USA's Secure Web Gateway is designed to extend web policy to office, remote, and roaming users. Confirm which devices and traffic are in scope, how the protected path is maintained, and what happens when it is unavailable. Windows and Linux application control should not be assumed to provide equivalent coverage for every mobile platform.
What should businesses change first?
Use AdFection to ask three concrete questions: Are unnecessary ads being blocked where employees actually browse? Are execution controls enforcing the intended policy? Can the security team investigate a suspicious sequence across web, network, and endpoint records?
Those answers produce a more useful security plan than asking employees to be more careful or assuming that one product covers the entire attack. The objective is to reduce opportunities for compromise and make suspicious activity easier to interrupt and investigate.
Network Box USA can help assess how web filtering, UTM+, White Cloud application control, and NBX monitoring fit your environment. Contact our team to request a Security Stack Review focused on your users, devices, and existing protections.