WHAT if simply reading the news, checking the weather or using a mobile application could expose your smartphone to spyware?
For years, Malaysians have been reminded to avoid suspicious links, unknown attachments and fraudulent websites. These remain important cybersecurity practices. However, a recent international investigation has revealed a more troubling possibility: sophisticated spyware can be delivered through online advertisements that we encounter every day.
On Oct 15, 2026, Citizen Lab, a research group at the University of Toronto, published a report titled "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware".
The investigation revealed how Discover-Tech, an Israeli advertising technology company, allegedly exploited the global digital advertising ecosystem to facilitate surveillance and deliver sophisticated spyware.
Perhaps most concerning for us is that Malaysia was among the countries identified in the investigation.
When ordinary advertisements become a security threat
To understand the significance of this discovery, we must first understand how online advertising works. Whenever we visit a news portal, browse a website or open a mobile application containing advertisements, an automated process often takes place behind the scenes.
Within milliseconds, advertising companies compete to display their advertisements to us. This process, known as real-time bidding, may involve sharing information such as our IP address, device characteristics, approximate location and advertising identifiers.
Ordinarily, this information helps businesses show advertisements relevant to our interests. However, Citizen Lab's investigation demonstrated how the same infrastructure can be exploited for surveillance.
Discover-Tech allegedly used its position within the advertising ecosystem to identify and profile
devices before selectively delivering malicious code to chosen targets. The most disturbing aspect is that the victim does not necessarily need to click on an advertisement.
In a so-called zero-click attack, malicious code may exploit vulnerabilities in a device's browser,
application or operating system simply through the automatic loading of advertising content.
If successful, spyware could potentially access sensitive information, including messages, files, location data and other personal information.
This challenges one of the most familiar cybersecurity assumptions: that avoiding suspicious links is sufficient to keep us safe.
Malaysia is on the list. Should we be worried?
According to Citizen Lab, Discover-Tech submitted more than 10 million advertising bids associated with IP addresses geolocated to Malaysia.
Researchers also identified Discover-Tech advertising impressions on government-operated networks in Malaysia.
These findings deserve attention, particularly because government networks may be associated with sensitive communications and information.
However, an important distinction must be made. The presence of Malaysia in the report does not mean that millions of Malaysian devices were infected with spyware.
Advertising bids are not the same as successful advertisement deliveries, and neither necessarily indicates that a device was compromised.
The report also does not establish that specific Malaysian devices were successfully infected through this operation.
Nevertheless, the findings demonstrate that Malaysia was within the reach of the advertising infrastructure examined by researchers.
For a country that increasingly depends on digital banking, e-government services, online healthcare, education and mobile applications, this should serve as a reminder that cybersecurity risks extend beyond fraudulent messages and suspicious websites.
The weakest link may be an invisible third party
Another important lesson from the investigation concerns the digital supply chain. When we visit a legitimate website, we naturally assume that its content is trustworthy.
Yet, many websites rely on external advertising networks and technology providers. These third parties may deliver content and execute code within our browsers without us knowing who they are.
Discover-Tech reportedly operated as an intermediary connecting legitimate advertising infrastructure with commercial spyware providers, including Candiru.
Citizen Lab confirmed that devices associated with the international news organisation Al Jazeera were infected with Candiru spyware through targeted advertising.
This illustrates a significant cybersecurity challenge: even legitimate websites and applications can become indirect channels for malicious activity when third-party services are abused.
The website itself need not have been deliberately compromised or involved in the attack.
The problem is therefore broader than one advertising company. It exposes weaknesses in an ecosystem where numerous organisations exchange personal information and deliver software content automatically.
What can ordinary Malaysians do?
The findings should encourage vigilance, not panic. There is no reason for every Malaysian to assume that their smartphone has been compromised merely because the country appears in the report.
Nevertheless, several practical precautions can significantly improve our digital security.
First, keep smartphones, computers, browsers and applications updated. Security updates often address vulnerabilities that sophisticated attackers attempt to exploit.
Second, consider using reputable advertisement-blocking and anti-tracking tools. While these cannot guarantee protection against every form of spyware, they can reduce unnecessary exposure to third-party advertising content.
Third, review privacy settings on smartphones. Where possible, disable personalised advertising, limit application tracking and restrict unnecessary access to location, microphone and camera functions.
Fourth, install applications only from trusted sources and remove applications that are no longer needed.
Finally, recognise that cybersecurity involves more than avoiding suspicious links. Even routine online activities deserve appropriate privacy and security safeguards.
Individuals who handle sensitive information, including journalists, researchers, government personnel and professionals working with critical infrastructure, should consider additional protections appropriate to their risk exposure.
Cybersecurity must also be a national responsibility
Although individuals can take precautions, the AdFection investigation demonstrates that personal vigilance alone is insufficient.
Malaysia's cybersecurity stakeholders, including the National Cyber Security Agency (Nacsa),
CyberSecurity Malaysia, telecommunication providers and relevant government agencies, should examine the implications of these findings.
A useful starting point would be to determine whether advertising activity identified on Malaysian government networks presents any indication of targeted surveillance or attempted exploitation.
Public institutions and businesses should also reconsider how third-party advertising technologies, external scripts and tracking services are managed on organisational devices and networks.
More importantly, organisations should recognise that cybersecurity is not limited to protecting their own servers and applications. It also involves understanding the security implications of external services and technology partners.
Digital advertising platforms, meanwhile, must assume greater responsibility for scrutinising advertisers and detecting malicious behaviour within their systems.
The response cannot depend solely on users protecting themselves against sophisticated threats that may be practically invisible to them.
Wake-up call for Malaysia's digital future
Malaysia's digital transformation continues to create opportunities for economic growth, innovation and public service improvements. Yet, increased digital connectivity also creates new avenues for cyber threats.
The AdFection investigation is particularly significant because it demonstrates how technology
designed for legitimate commercial purposes can be repurposed for surveillance and cyberattacks.
An online advertisement is no longer just an advertisement. Under certain circumstances, it can become a means of identifying, tracking and potentially compromising a device.
For ordinary Malaysians, the message is straightforward: remain vigilant, maintain good cybersecurity practices and take digital privacy seriously.
For organisations and policymakers, the challenge is greater. We must strengthen oversight of third-party technologies, improve cyber resilience and ensure that the digital services Malaysians depend upon are trustworthy.
The next major cybersecurity threat may not arrive through a suspicious email or fraudulent website. It could be hidden within an advertisement on a website we have trusted for years. That is why cybersecurity awareness must evolve alongside the threats themselves.
TS DR MOHD FAIRUZ ISKANDAR OTHMAN
Senior lecturer
Faculty of Information and Communication Technology
Universiti Teknikal Malaysia Melaka (UTeM)
