Researchers at the University of Toronto's Citizen Lab disclosed on Thursday that a spyware campaign they call AdFection used digital advertising to silently infect phones, which they describe as the first detailed public technical evidence of sophisticated spyware spreading through ads. The campaign allegedly involved an Israeli-registered advertising firm connected to spyware servers and infected dozens of devices with invasive malware. Because the attacks are zero-click, they can install malware without any interaction or mistake by the target.
Citizen Lab concluded that 45 devices belonging to the news outlet Al Jazeera were targeted in 2024 and 2025 by zero-click attacks delivered through ads. The researchers say the targeted ads came from the Israeli-founded marketing firm Discover-Tech and distributed spyware attributed to the Israeli developer Candiru. Infected devices contacted domains linked to Discover-Tech and then connected to infrastructure tied to Candiru, according to the lab's analysis. Al Jazeera, which took part in the investigation and shared device logs with the researchers, did not respond to a request for comment.
Discover-Tech operates an advertising platform called Controlium that the researchers say lets users de-anonymize, fingerprint, and automatically infect devices once an ad appears. They estimate millions of devices were directed to Candiru's servers, where they could be profiled. By analyzing ad-bidding records exposed publicly on the Discover-Tech website, the researchers say ads linked to the firm with attacker script tags appeared in more than 70,000 mobile apps and more than 120,000 websites between March and June of this year, with some apps displaying more than a million linked ads. The researchers also say they have seen Discover-Tech ad impressions on government and national-security-linked networks worldwide, including NATO and United Nations networks, European lawmaking bodies, Australian critical infrastructure providers, and armed forces and government agencies in Norway and Sweden.
Google terminated Discover-Tech's registration after working with Citizen Lab and the cybersecurity firm Confiant and confirming a spyware link. A Google spokesperson says the company blocked Discover-Tech from its ad platforms for systematically violating its policies and set up Safe Browsing warnings for websites linked to the group. IAB Europe, an ad industry body, confirmed it suspended Discover-Tech from its global vendor list, known as the GVL, following a policy audit, and says further confirmation could justify definitive expulsion. Beeswax, an online advertising company owned by Comcast, says it removed the firm from its platform after independent validation by a third-party security specialist and maintains a zero-tolerance policy for malicious advertising.
Bill Marczak, a senior researcher at Citizen Lab, says AdFection lets operators automatically hack specific individuals with mercenary spyware as they use apps or browse the internet, and that a person hacked this way would see nothing amiss, possibly not even an ad. Fellow senior researcher Wolfie Christl calls the risk of infection simply from using a site or app that shows ads a nightmare scenario. Marczak says the ability to push individualized, arbitrary content at specific users suits the mercenary spyware industry, and that the abuse will continue until the architecture changes or ad companies get serious about vetting customers. He also says the lack of prior reporting on such campaigns is likely a visibility issue, since defenders must be in the right place at the right time with the right data.
Discover-Tech and its CEO did not respond to emails and messages before publication, according to the source article. Integrity Partners, believed to own Candiru's assets following US government sanctions in 2021, also did not respond to requests for comment. Jason Kint, CEO of the digital media trade organization Digital Content Next, says that although such attacks are rare and sophisticated, he would not be entirely surprised to learn about zero-click attacks through ads, and that anything going against users' expectations or lowering trust in the open web is deeply concerning.
More cybersecurity news from TechManNews.
