AdFection shows how targeted ads can deliver zero-click spyware
Citizen Lab says a targeted advertising platform helped deliver mercenary spyware without requiring victims to click, exposing a deeper weakness in the ad ecosystem.
Researchers at the University of Toronto’s Citizen Lab say they have found the first publicly documented case of mercenary spyware being delivered through targeted online advertising without requiring a victim to click anything. The group calls the technique “AdFection” and says it was used to infect devices belonging to people at Al Jazeera with spyware attributed to Candiru, now also known as Integrity Labs.1
The finding matters because it joins two risks that users usually experience separately: invasive ad tracking and zero-click exploitation. Citizen Lab says a malicious advert could cause a targeted device to contact attacker-controlled infrastructure as soon as the advert was rendered. A person would not need to open a suspicious attachment, approve a download or tap a deceptive button. The report describes a capability, not evidence that every advert a user sees is malicious.
How the attack works
Online advertising is built around rapid auctions. A website or app offers an advert slot, a supply-side platform and demand-side platform exchange information, and an advert is selected in milliseconds. Citizen Lab says Discover-Tech operated a platform called Controlium that could allow mercenary spyware partners to de-anonymise, fingerprint and automatically infect devices when an advert appeared.1
The researchers analysed four billion Discover-Tech bidding records covering a four-month period. They say the company’s adverts appeared across almost 200,000 websites and Android and iOS apps, while millions of devices were directed to infrastructure associated with Candiru. Citizen Lab also links Discover-Tech to other surveillance-related actors and says the company’s advertising activity reached networks connected to governments and international organisations.1
The report separates the scale of the advertising exposure from confirmed infections. Citizen Lab says it confirmed spyware infections on 45 Al Jazeera devices during attacks in 2024 and 2025, with network evidence indicating that the infections were delivered through adverts. It does not claim that every device exposed to Discover-Tech infrastructure was compromised.
The researchers disclosed their findings to advertising companies and industry groups. Citizen Lab says Google blocked Discover-Tech from its ad platforms, IAB Europe suspended the company from its Global Vendor List, and Beeswax removed it from its platform after independent validation. Discover-Tech and people associated with the spyware operation did not respond to all requests for comment by the report’s publication deadline, according to WIRED’s account of the research.12
For ordinary users, the uncomfortable lesson is that the usual advice to avoid suspicious links is incomplete. Zero-click attacks do not depend on a user making an obvious mistake. Keeping phones and browsers updated still matters, and reducing exposure to intrusive advertising may reduce some risk, but neither step is a guaranteed defence against a sophisticated, targeted exploit. Citizen Lab argues that the advertising ecosystem itself needs stronger vendor checks, technical safeguards and oversight.
Our opinion
AdFection is significant less because it proves that every ad is dangerous than because it shows how much trust the ad ecosystem quietly receives. The same machinery used to decide which advert appears on a phone can carry device identifiers, location signals and code from a large chain of intermediaries. If those intermediaries cannot reliably identify a spyware distributor, the risk is structural rather than merely personal.
The evidence also deserves careful wording. Citizen Lab’s report is a serious primary investigation, but claims about corporate relationships and spyware attribution remain claims made by the researchers and should be attributed as such. The confirmed infections, the exposed bidding records and the industry responses are stronger anchors than the more sweeping idea that millions of devices were “hacked”.
That distinction does not make the result less alarming. It makes the practical demand clearer: advertising companies need to prove that their supply chains can reject mercenary spyware before it reaches a browser or app. Users can install updates and limit tracking, but they cannot audit a real-time bidding auction in the milliseconds before an advert appears.