# AdFection: The Nightmare Scenario of Spyware Delivered by Ads In a chilling revelation, researchers from **The Citizen Lab** at the University of Toronto have uncovered a "worst-case scenario" where sophisticated spyware silently infects targets as they interact with digital ads. This unprecedented method, termed "AdFection," represents a significant escalation in the threat landscape, demonstrating how the sprawling online advertising infrastructure can be weaponized for highly targeted surveillance. ## The Anatomy of a Zero-Click Ad Attack **Citizen Lab** documented a campaign where an Israeli-registered advertising firm allegedly connected to servers linked to a spyware company, leading to the infection of dozens of devices with invasive malware. This marks the first detailed public technical evidence of advanced spyware deploying through digital ads without any user interaction. Zero-click exploits are the holy grail for attackers, as they allow malware installation without any user action or misstep. While previous zero-click attacks often exploited vulnerabilities in mobile messaging apps, **AdFection** merges this stealthy attack vector with the ubiquitous online ad ecosystem, creating a potent and largely undetectable threat. **Bill Marczak**, a senior researcher at **Citizen Lab**, explains the insidious nature of these attacks: "AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet. Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all." ## The Challenge of Protection Protecting against such attacks is exceptionally difficult. As **Wolfie Christl**, another senior **Citizen Lab** researcher, notes, "The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario." Beyond blocking ads as thoroughly as possible, there are limited immediate defenses for individuals, a fact reportedly well-known to intelligence agencies like the **NSA** and **CIA**. ## Al Jazeera Targeted The investigation revealed that between 2024 and 2025, 45 devices belonging to the news outlet **Al Jazeera** were targeted with zero-click attacks delivered by ads. The researchers attribute these targeted ads to **Discover-Tech**, an Israeli-founded marketing firm, and the spyware to **Candiru**, an Israeli developer. **Citizen Lab**'s analysis showed a clear chain: infected devices first contacted domains linked to **Discover-Tech** before connecting to infrastructure associated with **Candiru**. **Marczak** highlights the inherent vulnerability of the ad architecture: "The ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem, and is perfectly suited to the mercenary spyware industry. Until this architecture changes, or ad companies get serious about customer vetting, we’re going to keep seeing this kind of abuse." ## Industry Response and Widespread Exposure In response to the findings, **Google**, a major player in online advertising, terminated **Discover-Tech**'s registration after a joint investigation with **Citizen Lab** and cybersecurity firm **Confiant** confirmed the spyware link. **Google** has also implemented Safe Browsing warnings for websites associated with the group. The European branch of the **Interactive Advertising Bureau (IAB)** has suspended **Discover-Tech** from its global vendor list (**GVL**) following an audit of its policies. **Beeswax**, an online advertising company owned by **Comcast**, also removed **Discover-Tech** from its platform, citing a zero-tolerance policy for malicious advertising. **Citizen Lab** researchers estimate that **Discover-Tech**'s advertising platform, **Controlium**, could "de-anonymize, fingerprint, and automatically infect devices" once an ad appeared, potentially directing millions of devices to **Candiru**'s servers for profiling. Analysis of publicly exposed ad-bidding records showed **Discover-Tech**-linked ads with attacker script tags on over 70,000 mobile apps and 120,000 websites between March and June of this year. While not all **Discover-Tech** ads were necessarily weaponized, their impressions were observed on sensitive networks globally, including those of **NATO**, the **United Nations**, European lawmaking bodies, critical infrastructure providers in Australia, and government agencies in Norway and Sweden. **Jason Kint**, CEO of **Digital Content Next**, acknowledged the plausibility and damage of such attacks: "Although rare and sophisticated, I wouldn’t be entirely surprised to learn about zero-click attacks through ads. Anything that goes directly against users’ expectations or lowers the trust in the open web is deeply concerning." This incident underscores the urgent need for enhanced vigilance, stricter vetting within the ad tech industry, and a re-evaluation of the security implications embedded within the digital advertising ecosystem.