Malware · Vulnerabilities · Privacy
Researchers find spyware can infect phones through online ads, no clicks needed
Citizen Lab has published evidence that spyware can silently infect phones through targeted online ads, without any user action. The campaign, called 'AdFection', reportedly targeted journalists and used ad tech to deliver the malware.
Ross Grant3 min read
The short version
Researchers have found that spyware can infect phones simply by showing a malicious advert, without you clicking on anything. The attack targeted journalists and used online ads to deliver the malware. Google and other ad companies have blocked the firm involved. Blocking ads can help, but this kind of attack is hard to stop completely.
By the numbers
- 45devices at Al Jazeera reportedly targetedWired
- 70,000+mobile apps displayed Discover-Tech adsWired
- 120,000+websites displayed Discover-Tech adsWired
- millionsdevices directed to Candiru's servers, according to researchersWired
What happened?
Researchers at The Citizen Lab reported that spyware was distributed via targeted online ads in a campaign called 'AdFection'. The attack reportedly infected at least 45 devices, mainly targeting journalists at Al Jazeera, between 2024 and 2025. The spyware was linked to the Israeli ad firm Discover-Tech and developer Candiru. Google and other ad industry bodies have since blocked Discover-Tech from their platforms.
Spyware delivered through online ads, no clicks required
Researchers at The Citizen Lab have published technical evidence that spyware can infect phones simply by displaying a malicious online advert. The campaign, which they call "AdFection", was uncovered during 2024 and 2025 and is believed to be the first time such a method has been documented in detail. The spyware was reportedly distributed by an Israeli-registered advertising firm, Discover-Tech, and linked to the spyware developer Candiru. According to Citizen Lab, at least 45 devices belonging to journalists at Al Jazeera were targeted this way. The news outlet participated in the investigation by sharing device logs, but did not comment publicly.Wired (opens in a new tab)
How the attack worked
Zero-click attacks are especially dangerous because they do not require the victim to click, tap or interact with anything. In this case, the spyware was delivered through the infrastructure of online advertising. When a targeted user browsed a website or used an app that displayed ads, their device could be infected automatically. According to Citizen Lab, the ad platform used by Discover-Tech (called Controlium) allowed attackers to identify, fingerprint and infect devices as soon as an ad appeared. The researchers estimate that millions of devices were directed to Candiru's servers, where they could be profiled, although only a smaller number were actually infected.
Who is affected and what was the response?
The campaign reportedly targeted journalists at Al Jazeera, but the researchers also found Discover-Tech ads on networks belonging to government agencies, critical infrastructure, and even military bodies in several countries. There is no evidence yet that all these networks were compromised, but the presence of the ads shows the potential reach of this technique. Google, which operates a major ad platform, confirmed it had worked with Citizen Lab and cybersecurity firm Confiant to investigate. Google has since blocked Discover-Tech from its ad platforms and issued Safe Browsing warnings for related sites. The Interactive Advertising Bureau (IAB) Europe has suspended Discover-Tech from its global vendor list, and Beeswax, an ad tech company owned by Comcast, also removed the firm from its platform.
What makes this attack different?
Zero-click spyware attacks have been seen before, but usually through messaging or communication apps. This is the first time researchers have published technical evidence of such attacks delivered through online advertising. The online ad ecosystem is complex and often trusted by websites and apps, making it a powerful tool for attackers. The ability to target specific individuals with tailored ads means attackers can be highly selective and stealthy. According to Citizen Lab, many users would not even see the malicious ad, let alone realise their device was infected.
What can users do?
Defending against zero-click ad attacks is difficult. The researchers recommend blocking ads as thoroughly as possible, using trusted ad blockers on all devices and browsers. However, even this may not be enough if attackers find ways to bypass ad blockers or target platforms where blocking is not possible. The incident highlights the need for stricter vetting of ad tech companies and greater oversight of the online advertising industry. Security professionals should monitor for unusual device behaviour and network connections to known spyware infrastructure, especially in high-risk environments.
What is not yet clear
This story is based on a single report from Wired, relying on Citizen Lab's research. There is no confirmation yet from affected vendors, government agencies, or Al Jazeera. The full scale of the campaign and whether other groups or individuals were targeted is unknown. It is also unclear how many devices were actually infected versus profiled or exposed to the malicious ads.
Claimed vs confirmed
- Confirmed
Spyware was distributed via online ads in a zero-click attack targeting Al Jazeera journalists.
Citizen Lab published technical evidence and device logs from Al Jazeera.
- Unconfirmed
Millions of devices were profiled or exposed to the spyware infrastructure.
Researchers estimate millions were directed to the servers, but only a smaller number were infected.
The impact
- Money
- No direct financial loss reported, but affected companies could face regulatory scrutiny. Under GDPR, fines can reach €20m or 4% of global turnover for serious privacy breaches.
- Reputation
- The incident raises questions about the trustworthiness of online ad platforms and the security of users' devices. Ad tech firms and publishers may face reputational damage if associated with spyware distribution.
- Customers
- Anyone using websites or apps with ads could be at risk. Users should consider ad blockers and monitor for unusual device behaviour, especially if they handle sensitive information.
Why it matters
Anyone who uses websites or apps with ads could be at risk from this kind of attack. Zero-click spyware is hard to detect and can be used to target journalists, government officials, or ordinary users. The incident shows how online advertising can be abused to deliver malware on a large scale.
How does it work?
The attack used online advertising infrastructure to deliver spyware through zero-click exploits. When a targeted user browsed a website or app displaying a malicious ad, their device could be infected automatically, without any interaction. The ad platform could fingerprint and profile devices, then deliver the spyware if the target matched the attacker's criteria.
Key points
- Spyware can infect devices through online ads without any user action.
- The attack targeted journalists and used ad tech to deliver malware.
- Google and other ad platforms have blocked the implicated firm.
- Zero-click attacks are hard to prevent and detect.
- Blocking ads can help, but is not a complete solution.
