Citizen Lab reveals AdFection: First confirmed zero-click spyware delivery via targeted ads

Key points

• Citizen Lab identified 'AdFection' as the first confirmed instance of zero-click spyware delivered via targeted ads, requiring no user interaction.
• The campaign infected 45 devices at Al Jazeera in 2024 and 2025 using spyware from Candiru, now rebranded as Integrity Labs.
• Discover-Tech, an Israeli ad firm, operated a platform called Controlium to profile users and facilitate spyware delivery through ad exchanges.
• Analysis of four billion bidding records showed Discover-Tech ads appeared on nearly 200,000 websites and apps between March and June 2026.
• Major ad vendors, including Google and IAB Europe, removed Discover-Tech from their certified vendor lists after Citizen Lab disclosed the findings.

Background

Recent security trends have highlighted the growing threat of zero-click exploits, such as the AI-assisted WeChat worm and the CLEANGULP malware chain involving Chrome and Windows vulnerabilities. While previous incidents relied on specific software flaws or network calls, the AdFection campaign represents a novel vector by weaponizing the standard digital advertising infrastructure. This follows earlier reports of ad tech being used for mass surveillance and tracking, but marks the first confirmed instance of it being used to install sophisticated spyware without user interaction.

How outlets are covering it

Ars Technica emphasizes the 'mercenary' nature of the attack, highlighting how Discover-Tech acted as a bridge between ad vendors and spyware ecosystems, and notes the lack of response from the implicated firms. The Guardian focuses on the broader implications for privacy, noting that the spyware could access messages, photos, and activate microphones, and stresses the failure of major ad vendors to detect the abuse for years. Citizen Lab provides the technical depth, detailing the 'Controlium' platform and the specific mechanism by which ad impressions triggered zero-click exploits, while also calling for regulatory action against the involved companies.

Why it matters

This incident exposes a critical vulnerability in the global digital advertising infrastructure, where routine ad auctions can be weaponized to silently install spyware on high-profile targets. The lack of detection by major platforms for years suggests systemic security failures that could affect journalists, government officials, and the general public. It underscores the need for stricter regulation and oversight of ad-tech vendors to prevent the exploitation of user data for malicious surveillance.

What to watch

Regulators in the US and Europe are expected to investigate whether Discover-Tech and Candiru violated privacy and security laws. Ad industry bodies may implement stricter vetting processes for vendors to prevent similar abuses. Users are advised to install ad blockers, reset mobile advertising IDs, and ensure timely software updates to mitigate risks. Citizen Lab is also working with vendors to address related mass-deanonymization attacks.