Modern online advertising has introduced a significant security risk, as devices can become infected with potent spyware merely by loading an advertisement. This process does not require any clicks or downloads by the user, nor does it give any warning.
Unveiling AdFection: A Zero-Click Threat
Researchers from Citizen Lab have brought to light the first public technical demonstration of a method they call ‘AdFection,’ which delivers zero-click spyware through targeted ads. This technique was notably used against devices at Al Jazeera, linking back to Israeli firm Candiru, now known as Integrity Labs.
According to their October 2026 report, at least 45 devices within Al Jazeera were compromised between 2024 and 2025. Network logs revealed the initial contact with Discover-Tech infrastructure post-ad display, subsequently connecting to a Candiru validation server and a command-and-control server for the spyware.
The Role of Discover-Tech in Spyware Distribution
Discover-Tech, masquerading as an advertising company, played a pivotal role as a conduit between the online ad ecosystem and commercial spyware operators. Through its Controlium platform, the company enabled spyware deployment using mobile ad IDs, browser cookies, and IP addresses.
Upon loading an ad, embedded code could ping a Discover-Tech server to check if the viewer was a target. If so, additional JavaScript would be returned, initiating the spyware infection process without user interaction.
Implications for the Advertising Industry
This method leverages the complexity of modern advertisements, which contain intricate code for tracking and content loading. Real-time bidding systems further exacerbate the issue by rapidly sharing device information, such as IDs and IP addresses, to optimize ad placement. AdFection exploits these features to surreptitiously infect selected devices.
Investigations into Discover-Tech’s operations uncovered a widespread campaign, with ads appearing on nearly 200,000 websites and apps globally. Although not all devices encountering these ads were infected, many were tracked and assessed for potential targeting.
Security Measures and Industry Response
The revelation of Discover-Tech’s actions prompted swift responses from major ad networks. Google, along with other platforms like IAB Europe and Vungle, took significant steps to sever ties with Discover-Tech.
To mitigate risks, users are advised to block known malicious infrastructure, scrutinize unusual ad-related traffic, and restrict advertising IDs. Additionally, browser isolation and strict controls on third-party scripts are recommended for enhanced security.
Citizen Lab’s findings underscore the urgent need for more rigorous security checks within the advertising industry. As online ads continue to serve as potential vectors for spyware, stronger industry standards and vigilant network monitoring are crucial to safeguarding user devices.
