Key points
- Citizen Lab researchers identified AdFection, a zero-click spyware delivery method using ad networks.
- Israeli firm Discover-Tech allegedly served malicious ads to specific targets via its Controlium platform.
- At least 45 Al Jazeera devices were infected with Candiru spyware in 2024 and 2025.
Security researchers at Citizen Lab have documented the first publicly confirmed instance of zero-click mercenary spyware being delivered through targeted online advertisements, according to The Register. This technique, labeled AdFection, allows attackers to infect smartphones simply when users load a webpage or application, eliminating the need for any clicks or downloads. The discovery highlights a severe escalation in mobile threat vectors that bypass traditional user-interaction defenses.
The investigation points to Discover-Tech, an Israeli advertising technology company, as the intermediary facilitating these attacks. Researchers assert that the firm operates as a bridge between the online advertising ecosystem and various spyware vendors, rather than functioning solely as a legitimate ad provider. By leveraging real-time bidding systems, the platform allegedly identified specific targets and served them malicious payloads disguised as standard advertisements.
Context and Background
The attack exploits the real-time bidding mechanism that determines which ads appear on digital properties. When a user loads a page, advertisers compete for space while receiving data about the device and location. Discover-Tech’s Controlium platform allegedly used this intelligence to pinpoint individuals and deliver spyware. Citizen Lab stated that serving as this bridge appears to be the company’s primary purpose, effectively turning ad networks into espionage delivery systems.
Who Is Affected
Devices belonging to Al Jazeera staff were among those compromised in this campaign. Citizen Lab traced infections on at least 45 devices at the news organization during 2024 and 2025 to Candiru spyware, now known as Integrity Labs. The spyware was delivered through ads sourced from Discover-Tech. This confirms that high-profile media organizations are exposed to this specific ad-based attack vector, which requires no user action to execute.
Next steps
Organizations should assume that standard web browsing can trigger zero-click exploits if ad networks are compromised. Teams must review their understanding of ad-tech supply chain risks. Monitoring for anomalous outbound connections from mobile devices remains critical while the full scope of Discover-Tech’s client base remains unclear. Since the source material does not confirm a fix, defenders should rely on network-level filtering and strict device isolation for high-value targets.
Signals worth monitoring
Teams usually detect this type of activity by reviewing mobile device management logs for unexpected configuration changes or new administrative profiles. Check whether endpoints are communicating with known command-and-control servers associated with mercenary spyware groups. Look for processes spawning from ad-related libraries or unexpected network traffic during idle periods. Containment moves typically involve isolating affected devices from the corporate network to prevent lateral movement and preserving forensic images for analysis before wiping the hardware.
What to do and how to stay safe: Discover-Tech
- Audit mobile device logs for unauthorized profile installations or configuration changes that occurred without user consent.
- Monitor network traffic for connections to known spyware command-and-control infrastructure, especially from high-risk personnel devices.
- Restrict ad-loading capabilities on corporate mobile devices using strict firewall rules or application whitelisting policies.
- Review ad-tech vendor contracts and supply chain risks to identify exposure to intermediaries like Discover-Tech.
Step-by-step guide: What Is Ransomware Protection: How to Stop Encryption Attacks
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does the AdFection attack work?
It uses targeted online ads to deliver zero-click spyware, infecting devices when users simply load a webpage or app without clicking anything.
Which company is accused of facilitating these attacks?
Israeli adtech firm Discover-Tech is allegedly acting as a middleman between advertising networks and spyware vendors like Candiru.
Who were the confirmed victims in this report?
Researchers traced infections to at least 45 devices at Al Jazeera in 2024 and 2025.
