
AdFection: First confirmed zero-click spyware delivery via targeted online ads
Citizen Lab and Confiant have confirmed the first known instance of 'AdFection,' a zero-click spyware attack delivered through targeted online ads. The Israeli firm Discover-Tech, operating under the guise of a legitimate ad agency, used its platform 'Controlium' to profile and infect devices for spyware vendor Candiru. At least 45 devices at Al Jazeera were compromised in 2024-2025. Major ad platforms, including Google and IAB Europe, have since banned Discover-Tech following the disclosure.

