AdFection: Citizen Lab confirms first zero-click spyware delivery via targeted ads

Key points

• Citizen Lab confirmed 45 Al Jazeera devices were compromised by spyware in 2024 and 2025.
• The attack, dubbed 'AdFection,' was the first confirmed zero-click mercenary spyware delivery via targeted ads.
• Israeli firm Discover-Tech acted as a broker, linking ad networks to spyware vendor Candiru.
• The malware could extract files, keystrokes, and camera/mic data without user interaction.
• Google, IAB Europe, and Beeswax removed Discover-Tech from their vendor registries after the report.

Background

This incident follows earlier reports of Candiru spyware targeting over 100 journalists and dissidents globally. Al Jazeera’s internal tech team first detected unusual device patterns in 2024, prompting the Citizen Lab investigation. The broader context includes ongoing concerns about state-sponsored surveillance and the vulnerabilities of digital advertising ecosystems.

How outlets are covering it

Al Jazeera framed the attacks as an assault on press freedom, condemning the targeting of its staff. Citizen Lab emphasized the structural flaws in the ad ecosystem, noting that Discover-Tech’s practices exposed millions of users to risk. Ars Technica highlighted the technical novelty of zero-click exploits and the lack of user interaction required for infection. While Al Jazeera focused on accountability, Citizen Lab and Ars Technica stressed the need for systemic ad platform reforms and user-side defenses like ad blockers.

Why it matters

This incident reveals a critical vulnerability in the digital advertising ecosystem, where targeted ads can be weaponized to install sophisticated spyware without user interaction. It underscores the risks for journalists, government officials, and civil society, and highlights the need for stricter ad platform security and user privacy measures.

What to watch

Ad platforms are expected to implement stricter vetting for vendors. Citizen Lab is calling for proactive government and industry action to prevent similar campaigns. Users are advised to use ad blockers and reset mobile advertising IDs to mitigate risks.