How dangerous are online ads?

From fake search results and stolen passwords to spyware that can infect devices without a click, online advertising has become an increasingly attractive tool for cybercriminals.

Security researchers have shown the same advertising machinery that nags you to buy something when you see it on the web can also be exploited to install spyware on someone’s device without them clicking anything at all.

Researchers at the University of Toronto’s Citizen Lab have uncovered a campaign they call AdFection, in which an Israeli company, Discover-Tech, allegedly helped spyware operators deliver malicious code through online advertisements. At least 45 devices at the news organization Al Jazeera were targeted in 2024 and 2025, with researchers confirming infections linked to the spyware maker Candiru.

The researchers analyzed nearly 4 billion advertising bidding records and found that Discover-Tech ads appeared on more than 120,000 websites and 70,000 mobile apps during four months in 2026 alone. Just because a user saw one of those adverts didn’t mean they were infected with malware. But it does show how far a malicious advertiser can reach using the same systems built to get advertisements in front of our eyeballs.

The real risk

Most people are thankfully unlikely to find themselves targeted by expensive commercial spyware – that’s reserved for politicians and journalists. Their bigger problem is something much more mundane: scam adverts that look legitimate.

Criminals can pay for ads that appear above ordinary search results, impersonating banks, software companies and other services. In April 2025, the FBI warned that fraudsters were doing just that with websites used by employees to manage their pay. Clicking a sponsored result took an unwitting victim to a phishing copy of the real website. And if they entered their login details, their private info would be stolen and their wages diverted.

Others use malicious advertising to push fake software downloads and dodgy browser updates onto users. The problem is large enough that Google says it blocked or removed 8.3 billion advertisements for policy violations in 2025, including 602 million of them associated with scams. To try to tackle the problem, they also suspended 24.9 million advertiser accounts. Those stats cover a broad range of rule-breaking, rather than billions of confirmed malware attacks, and along the way, Google also says its systems stopped more than 99% of violating adverts before anyone saw them.

Data digging

In addition to the risk of scam ads, they tend to gather far more data than is necessary. Information about devices, browsing habits and sometimes location regularly circulate through the advertising supply chain. The UK’s Information Commissioner’s Office has said that tracking people for targeted advertising requires consent – and warned that there’s too much data collected about users. In mid-October, Norway fined Microsoft-owned advertising firm Xandr 92 million kroner for sharing sensitive Grindr user data with thousands of advertisers between 2018 and 2020, before Microsoft bought the business.

So should we all stop clicking on adverts? It’s far more sensible to visit a company’s website directly. Alongside browsing smarter, keep your browser and devices up to date, and consider using an ad blocker.

But part of the trade-off of the free web is that adverts pay for keeping much of it free or low-cost. Most ads are harmless, and those that aren’t quickly get identified and acted on: Google and several other advertising businesses have cut off Discover-Tech following Citizen Lab’s findings. But the gap between their arrival on the web and being spotted and stopped still puts us at risk.