Code Before the Click

Uninvited on the Wire

Mara: Mardi Gras, 2013. Robert Silvie is home visiting his parents, and the web looks off. Sites like Apple, Walmart, Target, Bing and eBay are showing ads that don't belong there. Henkel checks the same sites on an Android phone and a Surface tablet. Same odd ads. So he turns off Wi-Fi on his phone, forcing it onto the cellular network. The ads go away. He turns Wi-Fi back on. They're back.

Eli: Which points at the connection in that house, not at Apple or Walmart.

Mara: Henkel spoke with several support staff members at CMA, and none of them believed his account. But it raised an uneasy question that a listener brought to us: Can an online ad really hack your computer without you clicking anything? Today's angle is from uninvited ads at Mardi Gras to zero-click spyware in ad auctions.

Eli: We trace how silent code delivery moved from unpoliced home networks into global ad auctions, and whether modern browser defenses still leave a quiet door open.

Mara: Most people assume a digital advertisement is just a passive picture sitting quietly on a page until a user clicks on it.

Eli: Display-ad content actually loads automatically onto a webpage without anyone clicking. In programmatic ad delivery—the automated auctions that sell and display ad space across networks—that loading process involves automated script execution, where the browser rendering automatically evaluates code embedded in an ad tag. That auction takes less than a tenth of a second, repeating billions of times every day.

Mara: So an ad slot is not an image file. It is active code running in the background.

Eli: Exactly. Because programmatic bidding sends impressions through dozens of intermediaries, malicious actors can buy placements or breach ad servers to push hostile scripts onto legitimate publisher websites without hacking the publishers themselves. That delivery of malware through online advertising networks is known as malvertising.

Mara: Henkel's discovery that third parties could act as a man-in-the-middle to inject unrequested scripts into browser sessions anticipated how automated programmatic exchanges operate at global scale.

Eli: Third-party scripts execute automatically when pages render, but whether they can seize control of a machine remains another matter.

The Exploit Kit Era

Mara: To find out what was happening on his parents' Wi-Fi, Henkel ran traceroutes to inspect every network hop his data took. He spotted an unauthorized detour: web requests were routed through an external proxy server, an intermediary that intercepts and relays web traffic, run by an entity called R66T. Right at the end of the webpage code, a single line had been injected calling an external JavaScript file from r66t.com. Silvie noticed the ads appeared only on unencrypted HTTP pages, never on encrypted HTTPS sites.

Eli: Their internet provider had quietly spliced an outside company into their private browsing traffic.

Mara: When Henkel showed his technical proof to CMA staff, he said, “They were very surprised” to learn the truth. Henkel remarked that the situation was really wrong, because companies felt free to operate as a man in the middle, injecting code into requests that users believed were private. He filed a formal complaint with the FCC, but on March 19, 2013, the agency replied that the issue was outside its jurisdiction and suggested contacting the FTC.

Eli: If third-party code can be injected without oversight, attackers can use that channel to install malware.

Mara: During that era, attackers did not just inject commercial banners; they weaponized web sessions through drive-by downloads.

Eli: A drive-by download is malware that installs itself just because a page loaded, by exploiting a software flaw. The tool behind it was usually an exploit kit, a server-side kit that checks a visitor's browser for unpatched holes. Blackhole had become one of the most popular by 2010, and Malwarebytes described it as a primary malware-delivery method in 2012 and much of 2013.

Mara: Didn't the visitor have to click on anything?

Eli: Not at all. As Check Point Research noted, serving exploits through ads let attackers reach huge audiences without user collaboration. In a drive-by attack, malicious code executes the instant an ad loads if the browser or a plugin contains an unpatched flaw. But these attacks depend on finding vulnerable software; they do not compromise patched machines, and an ad impression alone cannot infect every device.

Mara: In March 2016, a malvertising surge struck major portals including The New York Times, BBC, MSN, AOL, and Newsweek. Malicious ads redirected readers to the Angler exploit kit, silently installing ransomware without clicks.

Eli: Angler worked partly because so many people hadn't updated widely used browser plugins. Once a visitor was redirected to its malicious iframe, an embedded window that silently loads another webpage inside the page, it went looking for anything outdated to load malware through.

Mara: Automated plugin exploits once infected millions, but that widespread wave eventually receded, Eli.

The Sandbox Fortress

Eli: It receded because the browser itself got rebuilt. Browser sandboxing came in: walls around the part of the browser that draws a page, so code from the web can't freely reach the rest of the machine. Chrome turned on strict site isolation by default, keeping untrusted frames apart. And browser security mechanisms typically prevent forced redirects. Sandboxes are strong walls, but escapes can still exist.

Mara: To escape that sandbox without a click, an attacker needs a zero-day exploit.

Eli: That's where the economics changed. Industrial Monitor Direct reported in 2026 that a full zero-day chain for a modern browser engine routinely sells for somewhere between half a million and two and a half million dollars. That price floor, it said, keeps these tools off the indiscriminate market.

Mara: As browser defenses made unprompted remote code execution economically prohibitive, cybercriminals adapted by substituting expensive software exploits with cheap social engineering that tricks users into clicking.

Eli: Gen Digital reported that scams and other social engineering made up 86 percent of all attacks at the end of 2024. Most malvertising works after the click: a fake alert, a download, a page asking for a login.

Mara: Yet the walls still leak. Back in 2019, a malvertising group called eGobbler found a bug in Chrome on iOS. By estimate, it exposed about half a billion user sessions. It took under a week before Google's fix shipped. Those sessions were exposed, though none were reported compromised.

Eli: A sandbox leak can redirect traffic at scale, but actual device takeover demands far more firepower.

Mara: Henkel caught unpoliced code riding a home connection back in 2013. What nobody had shown in public yet was deep-pocketed attackers using an ad to get past a modern browser's defenses.

Eli: Whether real-world attackers could convert an unclicked ad into full device compromise remained an open question.

AdFection

Mara: On October 15, 2026, Citizen Lab published its AdFection investigation, confirming for the first time that mercenary spyware had infected physical devices through targeted ads without any user interaction. Mercenary spyware is commercial surveillance software sold to governments to covertly take over phones and laptops. The campaign targeted journalists and staff at Al Jazeera in 2024 and 2025, infecting at least 45 devices across iOS and Android.

Eli: The intrusion relied on an adtech vendor called Discover-Tech.

Mara: Discover-Tech turned the ad ecosystem into a targeting machine. As an ad rendered, it used client-side profiling—scripts running inside an ad slot that silently inspect device parameters and network identifiers. Millions of devices were directed to tracking infrastructure, but that did not mean they were infected. Bill Marczak of Citizen Lab noted that Discover-Tech leveraged the ad ecosystem for years to transform trusted sites and apps into a zero-click delivery pipeline.

Eli: How did an ad creative carry malware past ad platform scanners without raising immediate alarms?

Mara: Here's what slipped past the scanners: the ad itself carried no exploit. When it rendered, it sent device identifiers and IP information back to Discover-Tech's servers. The servers checked each device against targeting criteria. Most got nothing back. A selected few could get more JavaScript, potentially carrying an exploit that led to commercial spyware built by Candiru, another Israeli company. Which flaws it hit, and whether they were zero-days, holes the software's maker doesn't know about yet, hasn't been made public. And without special forensic tools, the attack was invisible.

Eli: Unlike eGobbler's noisy redirects, AdFection quietly profiled millions to deliver precision zero-click spyware to dozens. Protecting against that mechanism requires understanding the web's structural defenses, Mara.

The Man in the Middle

Mara: Henkel's 2013 warning lands differently now. When he saw ads spliced into web sessions at Silvie's parents' home, he said companies felt free to act as a man in the middle. In AdFection, that kind of in-between pipeline didn't just add banners. It let surveillance operators profile devices and deliver spyware, silently, as trusted pages rendered.

Eli: Discover-Tech operated inside major ad networks, including Google, Yandex, and Beeswax. To defend publishers, ad platforms rely on SafeFrame—an iframe sandbox standard that isolates an ad creative from the host page. Google notes that SafeFrame is enabled by default for reservation creatives and automatically applied to backfills, while proprietary scanning tools regularly check ad creatives for malicious behaviors.

Mara: SafeFrame creates a locked partition on the page so third-party scripts cannot peek at surrounding content.

Eli: It keeps the ad boxed in, and a site can back that up with a content security policy, a rule the site hands the browser listing which outside domains it may load scripts from or connect to. MITRE ATT&CK notes that ad blockers can help stop malicious ad code from executing in the first place, though they're not foolproof.

Mara: And the exploit has to land on a browser that actually carries the flaw it's built for. There's no universal payload, and current browser protections can interrupt the chain.

Eli: So, the listener's question. Yes, an online ad can hack a computer without a click, if what it delivers exploits an unpatched browser flaw as the ad renders. But that's hard and expensive. Jason Kint put it this way: "Although rare and sophisticated, I wouldn't be entirely surprised to learn about zero-click attacks through ads." A 2026 academic paper says such attacks are typically used by nation-states or elite groups against high-value targets: journalists, activists, executives. For anyone not targeted, the risk is very low.

Mara: That evidence gets read two ways. One reading, Kint's among them, is that sandboxes, automatic updates and ad-network filtering have made zero-click ad compromises exceptionally rare and expensive, mostly a matter for targeted operations.

Eli: The other reading looks at the machinery: exchanges this complex, running this fast, plus memory-safety bugs that keep turning up in browser engines, keep the risk systemic. Ron Deibert said it bluntly: "The moment the ad is rendered, their device can be hacked, so there's really no defence against this, short of not using a smart phone or not connecting to the internet."

Mara: Both readings rest on the same case. Where they part is whether it stays the exception.

Eli: Signals to watch include technical disclosures from browser vendors on the initial renderer flaw in AdFection, regulatory audits investigating how Discover-Tech maintained exchange access for six years, and intelligence detailing Candiru's sandbox escape chain.

Mara: The wire Henkel inspected in 2013 showed that third-party code could appear on trusted screens without asking permission. Today, keeping that silent pipeline in check depends on the invisible boundaries built into every browser tab.

Eli: For listeners wanting to look into the mechanics, read up on programmatic ad delivery.

Mara: Follow security with more stories from Angle as browsers confront silent targeting.

Eli: That's all for this one. I'm Eli.

Mara: And I'm Mara. Thanks for listening to Angle. Until next time.