AdFection Spyware Infects Devices via Zero-Click Online Ads

A covert advertising firm operating out of Israel has weaponized the global digital ad market to deliver government-backed spyware without requiring victims to click a single link, according to new findings from Citizen Lab.

The malware, identified as AdFection, represents the first confirmed instance of zero-click spyware deployed through real-time bidding networks. Unlike traditional malvertising campaigns that rely on users interacting with deceptive banners or pop-ups, AdFection executes silently the moment an advertisement renders on a screen. The discovery fundamentally alters how security researchers assess threats embedded within the programmatic advertising supply chain, an industry that processes billions of automated transactions daily.

Citizen Lab traced the infrastructure to Discover-Tech, a company that publicly markets itself as a standard advertising technology vendor. Researchers determined the firm functioned as a conduit between commercial ad exchanges and state-sponsored surveillance operators. Login records recovered from Discover-Tech’s systems included credentials tied to employees of Candiru, an Israeli surveillance software developer previously sanctioned by the U.S. Commerce Department in 2021 for selling tools used to target dissidents and journalists.

The targeting scope extended far beyond typical cyberespionage operations. Campaigns monitored by Citizen Lab hit devices connected to NATO, the European Commission, semiconductor firms NVIDIA and Arm, and staff at the Al Jazeera news network. Malicious advertisements were served across more than 120,000 websites — including domains operated by the BBC and The New York Times — and inside popular mobile applications such as Duolingo, Badoo, and Grindr. In total, researchers documented 442 million ad impressions linked to the operation, many landing on hardware used by military personnel, critical infrastructure operators, and national cybersecurity agencies.

Programmatic advertising relies on millisecond auctions where data brokers evaluate user profiles before serving tailored content. Discover-Tech exploited this architecture not to sell products, but to de-anonymize specific individuals browsing trusted platforms. Once a high-value target was identified through behavioral signals or device fingerprints, the system substituted legitimate ad creatives with payloads containing malicious code. This technique bypasses conventional endpoint defenses because the traffic originates from verified ad servers rather than suspicious external links.

The scale of the operation forced immediate action from major technology platforms. Google suspended Discover-Tech from its global vendor list following a joint investigation with Citizen Lab and Confiant, a security firm specializing in ad-fraud detection. “Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies,” the company stated.

Standard browser protections offer limited defense against this class of attack. Because the malicious code arrives through authorized channels, traditional ad-blockers that rely on static filter lists frequently miss dynamically generated payloads. Security professionals recommend high-risk individuals — particularly journalists, diplomats, and corporate executives — disable personalized ad tracking entirely or deploy DNS-level blocking solutions that prevent ad-network requests from resolving.

Neither Discover-Tech nor associated entities have responded to inquiries regarding the findings. Bill Marczak, a senior researcher at Citizen Lab, warned that the exposed network likely represents only a fraction of ongoing activity within the mercenary spyware ecosystem.

Confiant continues to monitor programmatic ad exchanges for residual infrastructure linked to the campaign, while European regulators face mounting pressure to apply intelligence-gathering oversight frameworks to the largely unregulated ad-tech sector.