Online advertising networks can now be used to install government-backed spyware on a phone or laptop with no action from the user. A new report from Citizen Lab documents a system, named AdFection, that infects devices by simply showing an ad, marking the first confirmed case of zero-click spyware attacks delivered through online advertising.<\/p>\n
AdFection is the name Citizen Lab gave to a spyware delivery method that exploits real-time ad bidding to reach specific victims. The attack requires no interaction: no link to click, no attachment to open. A malicious payload is hidden inside an ordinary ad served through the programmatic advertising ecosystem, and the device is compromised when the ad renders.<\/p>\n
Citizen Lab researchers describe this as the first confirmation of zero-click, government-backed spyware being distributed through online ads. The underlying technology was developed by Discover-Tech, an Israeli company that presents itself as a legitimate advertising firm. Citizen Lab’s report characterizes the company as a bridge between ad vendors and the mercenary spyware ecosystem, using the advertising system to profile and de-anonymize users before serving them targeted malicious ads.<\/p>\n
Programmatic advertising runs on an automated real-time bidding auction that lets advertisers compete to show ads to specific internet users based on profile data. Discover-Tech’s software entered that auction, used it to identify targets, and then delivered malware hidden inside innocent-looking ad creatives.<\/p>\n
Once a device was profiled, the malicious code was pushed through the same ad pipeline used for routine banner and video ads. Because the ads were delivered through mainstream ad networks, they appeared on trusted news sites and popular apps without raising user suspicion.<\/p>\n
Citizen Lab identified victims at the Al Jazeera news network, including journalists and staff, along with officials and employees at NATO, the European Commission, NVIDIA, and Arm. The ads were also served on devices used by militaries, governments, critical infrastructure operators, and national cyber agencies.<\/p>\n
The researchers noted that the targeted ad campaigns ran across more than 120,000 websites and reached a reported 442 million ad impressions. Websites named in the report include the BBC and The New York Times, alongside mobile apps such as Duolingo, Badoo, and Grindr.<\/p>\n
Google was among the major ad platforms whose infrastructure was used. Google has since removed Discover-Tech from its global vendor list following a joint investigation with Citizen Lab and Confiant. The company said Discover-Tech was blocked for systematically violating its policies. Google did not publicly detail how long the activity went undetected or how many impressions flowed through its pipes.<\/p>\n
Citizen Lab also found login records on Discover-Tech’s own site that appeared to belong to employees of Candiru, another spyware maker. The overlap suggests Discover-Tech operated inside a broader commercial spyware supply chain rather than as an isolated actor. Citizen Lab has framed its findings as the visible portion of a larger problem.<\/p>\n
Citizen Lab’s recommendation for people who may be targeted based on their role is to disable ad tracking on their devices or block ads altogether. Blocking ads removes the most common delivery channel for this class of attack, since the malicious payload relies on the programmatic ad system to reach the device. Limiting ad tracking also reduces the profile data that real-time bidding uses to match a malicious ad to a specific person.<\/p>\n
For organizations, the practical takeaway is that ad-blockers and network-level ad filtering are no longer just privacy tools; they are a defensive layer against mercenary spyware. Security teams handling at-risk staff can deploy managed ad-blocking on managed devices to close this delivery route.<\/p>\n
Discover-Tech and other entities named in the report had not publicly responded at the time of publication.<\/p>\n
AdFection is the name Citizen Lab gave to a zero-click spyware delivery system that hides malicious code inside online ads served through programmatic advertising networks. It is the first confirmed case of government-backed spyware distributed through online advertising.<\/p>\n
Citizen Lab attributes the technology to Discover-Tech, an Israeli company that presents itself as a legitimate advertising firm. Google has since suspended Discover-Tech from its global vendor list after a joint investigation with Citizen Lab and Confiant.<\/p>\n
Citizen Lab identified targets at Al Jazeera, NATO, the European Commission, NVIDIA, and Arm, along with militaries, governments, critical infrastructure, and national cyber agencies. The ads reached an estimated 442 million impressions across more than 120,000 websites.<\/p>\n