Citizen Lab details AdFection, a zero-click spyware campaign where an Israeli ad company routed targets to spyware servers and infected dozens of devices

Digital ads now carry a risk of automatic malware infection, even if no ad is seen.

Citizen Lab has detailed "AdFection," a sophisticated spyware campaign that infected dozens of devices by routing targets through an Israeli advertising firm to spyware servers. This campaign is notable as the first publicly documented instance of zero-click spyware being distributed via digital ads. The attackers, linked to the Israeli ad firm Discover-Tech and spyware developer Candiru, exploited the online advertising ecosystem to deliver malware automatically without any user interaction. Between March and June this year, ads linked to Discover-Tech appeared in over 70,000 mobile apps and 120,000 websites, potentially directing millions of devices to Candiru's servers. The campaign targeted 45 devices belonging to Al Jazeera during 2024 and 2025. Google has since terminated Discover-Tech's registration and implemented Safe Browsing warnings, while IAB Europe suspended the firm from its vendor list.

The "AdFection" campaign signifies a critical convergence of the online advertising infrastructure and the mercenary spyware industry. By exploiting the real-time bidding process and data collection inherent in digital advertising, attackers can bypass traditional security measures and target individuals with "zero-click" exploits. This blurs the lines between everyday online activity and targeted surveillance, posing a significant challenge for user protection and privacy.

The involvement of established ad tech firms and the broad reach of their platforms highlight the systemic vulnerabilities within the digital advertising ecosystem. As Google, IAB Europe, and other industry players take action against Discover-Tech, the incident underscores the urgent need for stricter vetting of ad vendors and a fundamental re-evaluation of how ad content is delivered and monitored across the web.