AdFection: Online Ads Used to Deliver Zero-Click Spyware, Researchers Reveal

Researchers at the Citizen Lab, based at the University of Toronto, have revealed the first details of zero-click spyware delivered through targeted advertising. They call the campaign AdFection. Zero-click means a victim does not need to click on anything for their device to be affected. The researchers say Discover-Tech, an Israeli company that presents itself as a legitimate advertising firm, actually acts as a facilitator for several mercenary spyware partners, including the well-known vendor Candiru. Its ads covertly direct millions of devices to contact Candiru's servers.

The likely goal is large-scale tracking and surveillance, and the researchers say major industry players such as Google enabled it by accident. The campaign led to infections of devices at media outlet Al Jazeera. Partner investigators at ad security firm Confiant also found the ads on many sensitive networks, including the U.S. Department of Defense, NATO, the International Atomic Energy Agency and cybersecurity agencies around the world.

The findings raise hard questions for regulators and the advertising industry. Citizen Lab says regulators need to investigate Discover-Tech and impose sanctions. Confiant's Jerome Dangu said the industry has focused on criminals and scams aimed at making money, but not on surveillance. Citizen Lab's Wolfie Cristl called it "disastrous" that ad vendors failed to detect the operation for years. Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024, while the related DARK CARTOGRAPHER activity dates back to 2019.