Citizen Lab Details 'AdFection' Zero-Click Spyware Delivered via Online Ads

Researchers at Citizen Lab have published a report detailing a technique they call "AdFection," which they describe as the first-ever public confirmation of zero-click mercenary spyware delivered via targeted online advertisements. The report, published on October 15, 2026, identifies an Israeli company, Discover-Tech, as the facilitator of these attacks, which infected devices at the news network Al Jazeera with spyware from Candiru.

How AdFection Works

According to Citizen Lab, the attack exploits the real-time bidding (RTB) infrastructure of the online advertising ecosystem. When a user visits a website or uses an app, an ad auction takes place. If Discover-Tech wins the bid, an ad is served to the device. The ad contains a script that connects back to a Discover-Tech server, referred to as a "NOAS server."

This server analyzes the user's IP address and advertising identifiers. If the user is a target, the server returns JavaScript code. "The NOAS server decides, apparently based on a combination of the source IP address and the advertising identifiers, whether the target is eligible to receive any JavaScript," the report states. This code can then load further scripts, potentially leading to a browser exploit and spyware installation. The infection occurs without the user clicking the ad or downloading a file.

Discover-Tech and Controlium

Citizen Lab identifies Discover-Tech as a bridge between the advertising industry and mercenary spyware vendors. The company operates a platform called Controlium, which allows partners to "de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered." The report notes that Discover-Tech appeared on lists of "certified" and "approved" vendors maintained by Google and IAB Europe until early October 2026.

The investigation revealed that Discover-Tech worked with multiple surveillance vendors, including Candiru (rebranded as Integrity Labs), Bindecy, and Intelos. Candiru was blacklisted by the US government in 2021. "Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform," said Bill Marczak, a senior researcher at Citizen Lab.

Scale and Targets

Analysis of four billion Discover-Tech bidding records showed that between March and June 2026, the company's ads were shown on almost 200,000 unique websites and Android/iOS apps. The ads reached networks associated with NATO, the United Nations, the European Commission, and various government agencies. While Citizen Lab confirmed infections at Al Jazeera, it noted that other organizations may have been profiled rather than infected.

"The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario," said Wolfie Christl, a senior Citizen Lab researcher. The report highlights that Discover-Tech's ads appeared on major platforms including Yahoo, BBC, and The New York Times, as well as apps like Duolingo and Grindr.

Industry Response

Following the investigation, major ad vendors took action. Google terminated Discover-Tech's access to its ad exchange platforms. "Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies," a Google spokesperson said. IAB Europe suspended Discover-Tech from its Global Vendor List, and Beeswax removed the company from its platform.

Why it matters

The AdFection report demonstrates a significant shift in the threat landscape for digital privacy and security. By weaponizing the ubiquitous and trusted infrastructure of online advertising, spyware vendors can target individuals with unprecedented stealth. The lack of user interaction required for infection makes traditional security awareness training ineffective. The incident underscores structural flaws in the ad-tech industry's vetting processes, as Discover-Tech operated within approved vendor ecosystems for years while facilitating espionage. It raises urgent questions about the security of the open web and the need for stricter regulatory oversight of ad-tech intermediaries.

---

Sources

• citizenlab.ca: Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab
• wired.com: ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads | WIRED
• ft.com: New ‘zero-click’ spyware hacked phones using targeted ads
• shattered.io: Zero-Click Spyware Ads: Citizen Lab's AdFection Report
• finance.biggo.com: Zero-Click Spyware Delivered Through Online Ads Infected Al Jazeera Devices, Researchers Say — BigGo Finance
• gigazine.net: A zero-click attack called 'AdFection,' which infects users with spyware simply by displaying online advertisements, has been confirmed. What was the attack method used by the Israeli advertising company? - GIGAZINE

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.