A New Vector for Mercenary Spyware
Researchers at The Citizen Lab at the University of Toronto revealed on Thursday a sophisticated digital espionage campaign dubbed “AdFection.” The findings provide what is described as the first detailed technical evidence of zero-click mercenary spyware infecting target devices simply as users browse past online advertisements. Unlike traditional malware vectors that require a user to click a malicious link or download an unauthorized file, zero-click attacks execute automatically without any victim interaction.
According to a 72-page report released by The Globe and Mail, the campaign leveraged the sprawling infrastructure of the online advertising ecosystem. The attacks were orchestrated using an Israeli-registered advertising firm, Discover-Tech, which allegedly connected servers to distribute malware linked to the Israeli spyware developer Candiru, whose assets are believed to be owned by Integrity Partners following U.S. government sanctions in 2021.
Targeting Journalists and Global Institutions
The investigation uncovered that between 2024 and 2025, at least 45 devices belonging to journalists at the news outlet Al Jazeera were targeted with zero-click attacks delivered by ads. Infected devices made contact with domains linked to Discover-Tech before connecting to infrastructure associated with Candiru. Al Jazeera participated in the investigation by sharing device logs with the researchers.
Beyond media organizations, the scope of the infrastructure involved national-security-sensitive networks globally. Analysis of publicly exposed ad-bidding records indicated that ads linked to Discover-Tech with attacker script tags appeared in more than 70,000 mobile apps and 120,000 websites between March and June. These ad impressions reached government offices, defense ministries, and critical infrastructure networks across multiple jurisdictions, including the Prime Minister’s Office of Armenia, as well as institutional networks in Norway, Sweden, Denmark, and Italy.
Industry Fallout and Real-Time Bidding Vulnerabilities
Major technology and advertising entities have taken swift enforcement action following the disclosures. Google announced it terminated Discover-Tech’s registration after a joint investigation with Citizen Lab and cybersecurity firm Confiant, while also implementing Safe Browsing warnings. Additionally, IAB Europe suspended Discover-Tech from its global vendor list pending further audits, and Comcast-owned Beeswax removed the firm from its advertising platform.
Security experts emphasize that the core vulnerability stems from the real-time bidding architecture underpinning digital advertising. The automated auction process operates within milliseconds, collecting vast troves of device and location data while offering malicious actors an avenue to push arbitrary code. Researchers note that defending against such automated ad-based threats remains exceptionally difficult for individual users, leaving comprehensive ad blocking as one of the few viable defensive mitigations.