Every time a webpage loads an ad, a silent negotiation occurs between dozens of data brokers, ad exchanges, and technology vendors. Most of the time, that negotiation ends with a banner you scroll past. In the case documented by the University of Toronto’s Citizen Lab in its report published Thursday, it ended with mercenary spyware installed on a journalist’s phone without a single tap or click from the victim.
The campaign, which Citizen Lab named AdFection, is what researchers describe as the first publicly confirmed technical evidence of zero-click mercenary spyware delivered through targeted digital advertising. The scale and method expose a structural flaw in the online advertising system that regulators, platform operators, and media organizations are only beginning to reckon with.
How AdFection Worked
The attack chain began with Discover-Tech, an Israeli company that presented itself to the advertising industry as a standard ad broker. Citizen Lab’s investigation found that Discover-Tech operated a platform called Controlium, which enabled its mercenary partners to fingerprint, identify, and automatically infect a device the moment an advertisement rendered on screen. No tap. No link. No file download initiated by the user.
When a target device loaded a page or opened an app carrying a Discover-Tech ad, JavaScript or similar code within the ad connected to servers controlled by Candiru, an Israeli spyware developer that has since rebranded as Integrity Labs. Candiru’s servers then returned an exploit that silently installed the spyware payload. The target saw nothing unusual. According to Citizen Lab senior researcher Bill Marczak, the target might not have even seen the ad itself.
What is AdFection spyware?
AdFection is the name Citizen Lab gave to a zero-click spyware campaign in which targeted ads delivered mercenary malware to devices without requiring any action from the target.
Who was behind the AdFection zero-click ad attacks?
Citizen Lab attributed the attacks to Discover-Tech, an Israeli advertising firm that facilitated delivery, and Candiru (rebranded as Integrity Labs), the Israeli spyware developer whose infrastructure received the exploited device connections.
Can an ad blocker protect against zero-click spyware in ads?
Citizen Lab senior researcher Bill Marczak said that blocking ads as thoroughly as possible on all websites and platforms is currently one of the few practical defenses against zero-click ad-based spyware attacks.
Want to go deeper? Ask NEX, the Decrypted Matrix research assistant, about the documents behind this story. It indexes every article here the day it is published and cites its sources.
