AdFection: How Ad Networks Enabled Zero-Click Spyware Attacks

Key points

• Citizen Lab confirmed the first public technical evidence of zero-click spyware delivered via targeted online ads, a technique they named 'AdFection.'
• The Israeli firm Discover-Tech, operating through its platform Controlium, acted as a bridge between ad networks and mercenary spyware vendors like Candiru.
• At least 45 devices belonging to Al Jazeera were infected in 2024 and 2025, with the spyware capable of accessing messages, photos, and activating microphones.
• Discover-Tech’s ads were displayed on over 120,000 websites and 70,000 apps, targeting users in government, defense, and critical infrastructure sectors.
• Major ad vendors, including Google, IAB Europe, and Beeswax, have suspended or banned Discover-Tech following the disclosure of these findings.

Background

This development follows earlier concerns about the opacity of the digital advertising ecosystem. In August 2026, researchers identified the P7 DarkSword variant, which also used malicious ads to target unpatched iPhones, highlighting a growing trend of ad-based exploitation. Additionally, in September 2026, the 'WeWorm' incident demonstrated how AI-assisted tools could hijack digital infrastructure, underscoring the broader risks of unregulated data flows in global networks.

How outlets are covering it

While The Guardian and Financial Times emphasize the scale of the targeting, noting that Discover-Tech’s ads reached networks of NATO, the UN, and major tech firms like Nvidia, WIRED focuses on the 'nightmare scenario' of zero-click infections, highlighting the lack of user protection. Citizen Lab provides the technical depth, detailing how Controlium de-anonymizes users via real-time bidding. All sources agree that the ad industry’s failure to detect this abuse for years represents a systemic security failure, though WIRED notes that previous zero-click ad campaigns may have gone unreported due to a lack of visibility in personal device logs.

Why it matters

The exposure of AdFection reveals a critical vulnerability in the global digital advertising system, where trusted infrastructure is being weaponized for state and mercenary surveillance. It underscores the urgent need for regulators to investigate ad vendors and implement stricter vetting processes to prevent the exploitation of real-time bidding for malicious purposes.

What to watch

Regulators in the US and Europe are expected to investigate whether Discover-Tech and Candiru violated applicable laws. Industry bodies are likely to tighten vendor certification processes, while cybersecurity agencies will continue to monitor for similar 'AdFection' attacks. Citizens and organizations may need to adopt more aggressive ad-blocking measures to mitigate the risk of zero-click infections.