AdFection: Researchers Uncover Sophisticated Spyware Campaign Exploiting Global Digital Advertising Infrastructure

In a development that has sent shockwaves through the cybersecurity and advertising technology industries, researchers at The Citizen Lab at the University of Toronto have documented a severe security breach dubbed AdFection. This campaign represents a disturbing evolution in the landscape of digital surveillance: the use of legitimate, automated digital advertising networks to deliver zero-click spyware to unsuspecting targets. Unlike traditional malware attacks that require a user to click a malicious link or download an infected file, AdFection leverages the silent, real-time mechanics of the online ad ecosystem to compromise mobile devices. The discovery confirms that the pervasive infrastructure used to serve everyday banner ads and promotional content has been weaponized by mercenary spyware developers to achieve high-level surveillance with zero user interaction.

The Anatomy of the Attack

The core of the AdFection campaign centers on the exploitation of real-time bidding (RTB) protocols—the high-speed, automated auctions that determine which ads appear on a user’s screen in milliseconds. By injecting malicious scripts into these ad streams, operators can push code to a device simply because that device loaded a webpage or opened an app. Once the ad is served, the malicious payload initiates a silent infection, bypassing the need for a victim to engage with the advertisement.

Bill Marczak, a senior researcher at The Citizen Lab, emphasized the invisibility of the threat. A user targeted by this method would likely notice nothing out of the ordinary. In many cases, the malicious ad script executes so efficiently that the user might not even see an advertisement displayed on their screen at all. This "worst-case scenario" for digital security effectively transforms the entire open web—and the millions of applications that rely on ad-supported revenue models—into a potential vector for state-sponsored or mercenary surveillance.

Chronology and Targeting

The investigation into AdFection, conducted throughout 2024 and 2025, identified 45 devices belonging to employees of the news organization Al Jazeera that were specifically targeted by these zero-click ad attacks. The technical evidence suggests a clear chain of command: advertisements were issued by an Israeli-founded marketing firm, Discover-Tech, which then redirected the targeted devices to digital infrastructure controlled by the Israeli spyware developer Candiru.

The campaign operated on a massive scale. By analyzing publicly exposed ad-bidding records, researchers determined that between March and June of 2025, advertisements linked to Discover-Tech were served across more than 70,000 mobile applications and 120,000 websites. While not every impression served by the platform was weaponized, the sheer volume of exposure is unprecedented. The researchers identified evidence that these ads were displayed on networks belonging to sensitive organizations, including NATO, the United Nations, various European legislative bodies, and critical infrastructure entities in Australia, Norway, and Sweden.

The Role of Discover-Tech and Candiru

Discover-Tech, through its "Controlium" advertising platform, appears to have functioned as the delivery mechanism for the spyware. Citizen Lab’s analysis indicates that the platform possessed the capability to de-anonymize users, fingerprint their device hardware, and facilitate the delivery of malicious payloads.

Candiru, the firm widely believed to be the ultimate beneficiary of this access, has long been a subject of international scrutiny. Following its inclusion on the United States Department of Commerce’s Entity List in 2021—a move that effectively sanctioned the firm for developing tools that enable foreign governments to conduct malicious cyber activities—the company has operated in the shadows. Integrity Partners, the firm reportedly holding Candiru’s assets, has remained silent in the face of inquiries regarding the AdFection campaign. Similarly, Discover-Tech and its executive leadership have failed to respond to multiple requests for comment from media outlets regarding their role in the dissemination of spyware.

Official Responses and Industry Action

The fallout from the Citizen Lab disclosure has been swift. Google, which maintains one of the world’s most extensive ad-delivery networks, has permanently terminated Discover-Tech’s registration. In an official statement, a Google spokesperson confirmed that the decision followed a joint investigation with The Citizen Lab and the cybersecurity firm Confiant. "We blocked Discover-Tech from our ad platforms for systematically violating our policies and have implemented Safe Browsing warnings to protect users from domains associated with this group," the statement read.

Other industry bodies have followed suit. The European branch of the Interactive Advertising Bureau (IAB) has suspended Discover-Tech from its Global Vendor List (GVL), a move that effectively restricts the company’s ability to participate in major European ad-auctions. A spokesperson for the IAB Europe indicated that the findings are currently under review, noting that definitive expulsion remains a possibility should the evidence of spyware distribution be fully corroborated through further audits. Furthermore, Beeswax, an advertising technology firm owned by Comcast, confirmed the removal of Discover-Tech from its platform, citing a "zero-tolerance policy for malicious advertising."

Implications for Global Security

The rise of AdFection underscores a fundamental, systemic flaw in the modern internet: the implicit trust placed in the digital advertising supply chain. For years, security professionals have warned that the RTB process is a privacy disaster, with data brokers collecting vast amounts of location and behavioral data. However, the transformation of this data-harvesting machine into a delivery vehicle for zero-click malware represents a significant escalation in risk.

Intelligence agencies, including the NSA and the CIA, have long recognized the inherent dangers of the ad ecosystem, with reports suggesting that internal protocols often mandate the use of rigorous ad-blocking software on government-issued devices. Yet, for the average citizen, such protections are rarely employed. Wolfie Christl, a senior researcher at The Citizen Lab, noted that for the general public, there is almost no defense against a zero-click attack delivered via a standard browser or mobile app. "The risk of having your device infected simply by using a website or app that displays ads is a nightmare scenario," Christl stated.

Analysis: A Failure of Oversight

The AdFection campaign exposes the lack of stringent vetting processes within the ad-tech industry. Because the bidding process occurs in milliseconds, malicious actors can hide behind layers of shell companies and automated proxies. The fact that Discover-Tech was able to integrate into the advertising networks of major global entities without its underlying malicious capabilities being flagged is a testament to the "move fast and break things" culture that has historically defined the ad-tech sector.

As Jason Kint, CEO of Digital Content Next, observed, the damage goes beyond individual privacy. Such attacks erode the fundamental trust that the open web relies upon. When a user can no longer browse a news site or check a weather app without the risk of being infected by state-grade surveillance tools, the utility of the internet as a tool for free information and global communication is severely compromised.

Conclusion

The disclosure of the AdFection campaign serves as a wake-up call for the technology sector. The mercenary spyware industry has proven itself capable of pivoting to new, more invasive methods of infection that bypass traditional software security. Unless the advertising industry adopts more rigorous vetting protocols, moves toward more transparent supply chains, and acknowledges the security risks inherent in real-time ad bidding, the threat of silent, zero-click infection will persist. As it stands, the digital advertising ecosystem remains a high-value, poorly defended target, providing the perfect cover for those who wish to watch, track, and compromise the world’s most sensitive individuals. The Citizen Lab’s investigation has brought this reality into the light, but the task of securing the digital architecture of the future has only just begun.