Hidden 'spyware' in online ads poses new threat

LETTER: Malaysians have been reminded to avoid suspicious links, unknown attachments and fraudulent websites. These remain important cybersecurity practices.

A recent international investigation has revealed a more troubling possibility, that sophisticated spyware can be delivered through the very online advertisements that we encounter every day.

On Oct 15, 2026, Citizen Lab, a research group at the University of Toronto, published a report titled 'Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware'.

It revealed how Discover-Tech, an Israeli advertising technology company, allegedly exploited the global digital advertising ecosystem to facilitate surveillance and deliver sophisticated spyware.

Perhaps most concerning is that Malaysia was among the countries identified in the investigation.

To understand the significance of this discovery, we must understand how online advertising works.

Whenever we visit a news portal, browse a website or open a mobile application containing advertisements, an automated process often takes place behind the scenes.

Within milliseconds, advertising companies compete to display their advertisements to us. This process, known as real-time bidding, may involve sharing information such as our IP address, device characteristics, approximate location and advertising identifiers.

Discover-Tech allegedly used its position within the advertising ecosystem to identify and profile devices before selectively delivering malicious code to chosen targets.

The most disturbing aspect is that the victim does not necessarily need to click on an advertisement.

In a so-called zero-click attack, malicious code may exploit vulnerabilities in a device's browser, application or operating system simply through the automatic loading of advertising content.

If successful, spyware could potentially access sensitive information, including messages, files, location data and other personal information.

This challenges one of the most familiar cybersecurity assumptions: that avoiding suspicious links is sufficient to keep us safe.

According to Citizen Lab, Discover-Tech submitted more than 10 million advertising bids associated with IP addresses geolocated to Malaysia.

Researchers also identified Discover-Tech advertising impressions on government-operated networks in Malaysia.

The presence of Malaysia in the report, however, does not mean that millions of Malaysians were infected with spyware.

Advertising bids are not the same as successful advertisement deliveries, and neither necessarily indicates that a device was compromised.

The report does not establish that specific Malaysian individuals were successfully infected through this operation.

Nevertheless, the findings demonstrate that Malaysia was within the reach of the advertising infrastructure examined by researchers.

For a country that increasingly depends on digital banking, e-government services, online healthcare, education and mobile applications, this should serve as a reminder that cybersecurity risks extend beyond fraudulent messages and suspicious websites.

Another important lesson from the investigation concerns the digital supply chain.

When we visit a legitimate website, we naturally assume that its content is trustworthy. Yet, many websites rely on external advertising networks and technology providers.

Malaysia's cybersecurity stakeholders, including the National Cyber Security Agency (NACSA), CyberSecurity Malaysia, telecommunications providers and relevant government agencies, should examine the implications of these findings.

A useful starting point would be to determine whether advertising activity identified on Malaysian government networks presents any indication of targeted surveillance or attempted exploitation.

Public institutions and businesses should also reconsider how third-party advertising technologies, external scripts and tracking services are managed on organisational devices and networks.

More importantly, organisations should recognise that cybersecurity is not limited to protecting their own servers and applications. It also involves understanding the security implications of external services and technology partners.

Digital advertising platforms must assume greater responsibility for scrutinising advertisers and detecting malicious behaviour within their systems.

The AdFection investigation is particularly significant because it demonstrates how technology designed for legitimate commercial purposes can be repurposed for surveillance and cyberattacks.

For ordinary Malaysians, the message is straightforward: remain vigilant, maintain good cybersecurity practices and take digital privacy seriously.

Meanwhile, organisations and policymakers must strengthen oversight of third-party technologies, improve cyber resilience and ensure that the digital services Malaysians depend upon are trustworthy.