AdFection: First confirmed zero-click spyware delivery via targeted online ads

Key points

• Citizen Lab and Confiant published the first technical evidence of zero-click mercenary spyware delivered via targeted ads, a technique they named 'AdFection.'
• The Israeli firm Discover-Tech, which presents itself as a standard ad agency, operated a platform called 'Controlium' to profile, de-anonymize, and target users for infection.
• Discover-Tech acted as a bridge between ad networks and spyware vendors, including Candiru (rebranded as Integrity Labs), which is blacklisted by the US government.
• At least 45 devices at the Qatari news network Al Jazeera were infected with Candiru spyware via Discover-Tech ads in 2024 and 2025.
• Analysis of over 4 billion bidding records shows Discover-Tech ads were served on nearly 200,000 unique websites and apps across dozens of countries.
• Major ad platforms, including Google, IAB Europe, Beeswax, Vungle, and Eskimi, removed or suspended Discover-Tech from their vendor registries and platforms following the report.

Background

This incident follows earlier reports of malicious ad-based attacks, such as the P7 DarkSword variant targeting unpatched iPhones via watering-hole attacks in August 2026. The AdFection campaign highlights structural vulnerabilities in the real-time bidding (RTB) advertising ecosystem, where opaque vendor relationships and lack of regulation allow malicious actors to leverage ad infrastructure for surveillance and espionage. Previous investigations have noted that ad tech data is increasingly used by intelligence agencies and mercenary firms for tracking and profiling.

How outlets are covering it

The Verge emphasizes the novelty of the zero-click delivery method and the immediate response from major ad platforms like Google and Beeswax. The Citizen Lab report, the primary source, provides deep technical detail on the 'Controlium' platform, the 4 billion bidding records, and the specific targeting of Al Jazeera, framing the issue as a systemic failure of the ad industry. The Guardian highlights the human rights implications, noting that the spyware can access messages, photos, and activate microphones, and criticizes the lack of regulation in the ad market. Ars Technica focuses on the technical mechanics of the zero-click exploit and the lack of detail on the specific vulnerabilities used, suggesting they may have been zero-days. All sources agree on the core facts but differ in emphasis: Citizen Lab on technical infrastructure, The Verge on industry response, The Guardian on privacy/human rights, and Ars Technica on the exploit mechanics.

Why it matters

The AdFection campaign demonstrates that the online advertising ecosystem can be weaponized for state-sponsored or mercenary espionage without any user interaction. It exposes significant structural flaws in ad vendor vetting and real-time bidding systems, which allowed Discover-Tech to operate at scale for years. This incident raises urgent concerns for journalists, government officials, and the general public, as it shows that simply viewing an ad can lead to device compromise. It calls for stricter regulation and security measures in the digital advertising industry to prevent similar mass surveillance and targeted hacking operations.

What to watch

Regulators in the US, Europe, and other regions are expected to investigate whether Discover-Tech and Candiru violated applicable laws. Ad industry organizations and platforms will likely implement stricter vetting and security measures for vendors to prevent similar abuses. Citizen Lab and Confiant are working with ad vendors to mitigate related threats, such as the 'DARK CARTOGRAPHER' campaign that links device IDs to phone numbers. Users are advised to use ad blockers, reset mobile advertising IDs, and keep devices updated to reduce risk.