Researchers from The Citizen Lab at the University of Toronto revealed on Thursday that they've uncovered spyware silently infecting targets as they browse past advertisements during everyday online activity. The attacks, which the researchers named "AdFection," involved an Israeli-registered advertising company allegedly connecting to servers linked to a spyware firm and infecting dozens of devices with invasive malware. Citizen Lab believes this marks the first publicly available detailed technical evidence of sophisticated spyware spreading through digital ads.
Between 2024 and 2025, Citizen Lab determined that 45 devices belonging to the news outlet Al Jazeera were hit with zero-click attacks delivered via ads. The targeted ads came from the Israeli-founded marketing company Discover-Tech and distributed spyware attributed to the Israeli developer Candiru, according to the researchers. Infected devices made contact with domains associated with Discover-Tech before connecting to infrastructure tied to Candiru. By examining ad-bidding records publicly exposed on the Discover-Tech website, the researchers say ads linked to the firm with attacker script tags appeared in more than 70,000 mobile apps and more than 120,000 websites between March and June this year. Multiple apps displayed more than a million ads connected to Discover-Tech. The researchers estimate that millions of devices were directed to Candiru's servers for potential profiling. The firm's ads showed up on government and national-security-linked networks worldwide, including NATO and United Nations networks, lawmaking bodies in Europe, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden.
"AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet," says Bill Marczak, a senior researcher at Citizen Lab. A person infected this way wouldn't notice anything wrong and might not even see any ad at all, he notes. The report states that Discover-Tech operates an advertising platform called Controlium that can let its users "de-anonymize, fingerprint, and automatically infect devices" once an ad appears. According to Marczak, the capacity to push individualized, arbitrary content at specific users is a defining feature of the modern online ads ecosystem and is perfectly suited to the mercenary spyware industry.
Zero-click hacks are highly valuable for attackers and devastating for victims because they can automatically install malware on devices without requiring any interaction or mistakes from the target. The report explains that when sophisticated hackers have deployed rare zero-click attacks in recent years, they've often exploited vulnerabilities in mobile messaging and communication apps to infect victims. But attackers have also exploited the sprawling infrastructure of the online ad ecosystem to distribute malware, sometimes with little or no interaction needed from victims. The evidence that Citizen Lab's researchers uncovered shows the two threats merging, underscoring the extent and urgency of the risk. The situation is particularly concerning because there isn't much that people can do to protect themselves from zero-click ad attacks other than blocking ads as thoroughly as possible on all websites and platforms, the researchers note.
Previous zero-click targeted ad campaigns that distribute spyware have rarely surfaced publicly, but the researchers say this is likely a symptom of ad infrastructure being so extensively trusted and incorporated in all aspects of digital life without specific oversight. Marczak says the network logs from Al Jazeera were crucial in understanding the ad-based nature of the attack, but if a user's personal device were targeted while connected to home Wi-Fi or mobile data, there wouldn't be the same level of network monitoring. He believes the lack of prior reporting is probably mainly a visibility issue: defenders have to be in the right place at the right time, looking at the right data. Google, which operates one of the world's largest advertising businesses, terminated Discover-Tech's registration after collaborating with Citizen Lab and researchers from the cybersecurity firm Confiant and confirming a spyware link. The European branch of the Interactive Advertising Bureau suspended Discover-Tech from its global vendor list following an audit of its policies. Beeswax, an online advertising industry company owned by Comcast, removed Discovery-Tech from its platform following recent activity and independent validation by a third-party security specialist. Until the architecture of online advertising changes or ad companies get serious about customer vetting, this kind of abuse will continue, the researchers warn. Organizations that rely heavily on digital platforms may need to reconsider how aggressively they deploy ad-blocking technologies, even if doing so conflicts with their typical approach to supporting content creators.