On Thursday, a team from the University of Toronto’s Citizen Lab disclosed a “worst‑case” scenario they observed in the wild: spyware silently infecting users as they scroll past online advertisements. The investigators labeled the operation “AdFection” after tracing a campaign that they say involved an Israeli‑registered advertising firm linked to a spyware server, resulting in dozens of devices being compromised. Citizen Lab claims this is the first publicly released technical proof of sophisticated spyware being delivered through digital ads.
Zero‑click exploits are prized by attackers because they can install malicious code without any user interaction, making them especially damaging. In recent years, rare zero‑click attacks have typically taken advantage of flaws in mobile messaging or communication apps. However, attackers have also turned to the vast online ad ecosystem to spread malware, sometimes requiring little or no action from the victim. The evidence uncovered by Citizen Lab shows these two tactics converging, highlighting a pressing risk.
“AdFection lets operators automatically infiltrate specific individuals with mercenary spyware while they use apps or browse the web,” explained Bill Marczak, a senior researcher at Citizen Lab. “A person hacked in this way would notice nothing unusual. In fact, they might not even see an ad at all.” He added that there is little users can do to defend against zero‑click ad attacks other than blocking ads as aggressively as possible across all platforms—a reality that intelligence agencies such as the NSA and CIA appear to understand well. “The prospect of having your device infected simply by visiting a site or using an app that shows ads is a nightmare scenario,” said Wolfie Christl, another senior researcher at the lab.
The lab’s analysis of 2024 and 2025 data indicated that 45 devices belonging to Al Jazeera were targeted with zero‑click attacks delivered via ads. The ads were traced to Discover‑Tech, an Israeli‑origin marketing company, and the spyware was linked to Candiru, an Israeli developer. Infected devices first contacted domains associated with Discover‑Tech before reaching infrastructure tied to Candiru, according to Citizen Lab’s findings. Al Jazeera, which cooperated with the investigation and provided device logs, did not comment when approached for further remarks.
“The ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem, and it fits perfectly with the mercenary spyware business,” Marczak said. “Until this architecture changes, or ad companies enforce stricter vetting, we will continue to see this kind of abuse.” Emails and messages sent to Discover‑Tech and its CEO by WIRED went unanswered before publication. Integrity Partners, believed to own Candiru’s assets after U.S. sanctions in 2021, also declined to comment.
Google, which runs one of the world’s largest advertising platforms, removed Discover‑Tech’s registration after working with Citizen Lab and the cybersecurity firm Confiant and confirming the spyware connection. “Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover‑Tech from our ad platforms for systematically violating our policies,” a Google spokesperson said. “We also set up Safe Browsing warnings to help protect people if they navigate to websites linked to this group.” The European branch of the Interactive Advertising Bureau (IAB) confirmed that it has suspended Discover‑Tech from its global vendor list, the GVL, after an audit of its policies. “Further confirmation of the findings regarding spyware could also justify a definitive expulsion from the GVL,” an IAB Europe spokesperson added. Beeswax, an online advertising company owned by Comcast, also said it removed Discover‑Tech from its platform after independent validation by a third‑party security specialist, emphasizing a zero‑tolerance stance on malicious advertising.
Online ads often appear through a process called real‑time bidding, an automated auction where advertisers compete to display specific ads within milliseconds. This system can collect massive amounts of data about a device’s location, browsing history and other personal details, creating long‑standing privacy concerns. Data brokers have historically sold such information, and law‑enforcement or hostile state actors have been known to purchase it for tracking or targeting purposes.
Citizen Lab researchers say Discover‑Tech operates an advertising platform called Controlium that can “de‑anonymize, fingerprint, and automatically infect devices” once an ad is served. They estimate that millions of devices were directed to Candiru’s servers, where they could be profiled. By examining ad‑bidding records publicly posted on Discover‑Tech’s website, the lab found that ads containing attacker script tags were shown in more than 70,000 mobile apps and over 120,000 websites between March and June of this year. Multiple apps displayed more than a million ads linked to Discover‑Tech.