AdFection: How Ad Networks Enabled Zero-Click Spyware Attacks
Citizen Lab has confirmed the first known instance of 'AdFection,' a zero-click spyware attack delivered via targeted online advertisements. The campaign, facilitated by Israeli firm Discover-Tech and spyware vendor Candiru, infected 45 devices belonging to Al Jazeera staff in 2024 and 2025. By exploiting real-time bidding infrastructure, attackers could automatically install malware without user interaction, targeting high-profile individuals across government and media networks. Major ad platforms, including Google and Beeswax, have since banned Discover-Tech, though experts warn the structural design of the ad ecosystem remains vulnerable to similar abuses.