Citizen Lab reveals AdFection: First confirmed zero-click spyware delivery via targeted ads
The University of Toronto’s Citizen Lab has published the first technical confirmation of zero-click mercenary spyware delivered through targeted online advertisements. The campaign, dubbed 'AdFection,' involved the Israeli firm Discover-Tech acting as a broker between ad networks and spyware vendors like Candiru. By exploiting real-time bidding data, attackers could profile and infect devices without any user interaction. Citizen Lab confirmed that 45 devices at Al Jazeera were compromised in 2024 and 2025. Following the report, major ad platforms including Google, IAB Europe, and Beeswax removed Discover-Tech from their vendor registries. The investigation highlights structural flaws in the digital advertising ecosystem, which allowed malicious actors to mass-profile users and deploy sophisticated malware across iOS and Android devices.