Researchers find spyware that infects phones via ads with no click at all

Citizen Lab documented for the first time a spying campaign that uses real-time ad auctions to infect devices without any interaction from the victim.

Citizen Lab, a security research lab at the University of Toronto, revealed, in an investigation published by Wired, the first publicly documented technical evidence of spyware infecting devices through digital ads. The researchers named the campaign "AdFection." The investigation covers attacks that took place throughout 2024 and 2025, with ad auction data collected between March and June of that year, a period prior to the report's publication.

According to the report, an advertising company registered in Israel, Discover-Tech, reportedly connected its infrastructure to servers linked to Candiru, an Israeli developer of mercenary spyware. Dozens of devices were infected without the victim needing to click on anything, simply by browsing apps and sites that displayed ads from the network.

How the attack works in practice

Zero-click attacks are the most coveted target of spying operations because they install malware without requiring any mistake from the user. Until now, this category of attack was associated almost exclusively with flaws in messaging and mobile communication apps.

What Citizen Lab found is different: the infection vector is the real-time ad auction system itself, real-time bidding (RTB), which decides in milliseconds which ad will be shown to each user based on device data, location, and browsing history.

AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet. Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all.

Bill Marczak, senior researcher at Citizen Lab

According to the researchers, Discover-Tech operates an ad platform called Controlium, capable of deanonymizing, fingerprinting, and automatically infecting devices as soon as an ad loads. Analyzing auction records publicly exposed on Discover-Tech's own website, Citizen Lab estimates that ads with attack scripts appeared in more than 70,000 mobile apps and more than 120,000 websites between March and June of that year, adding up to more than one million impressions linked to the firm in just a few apps alone.

The Al Jazeera case: two years of monitoring

During 2024 and 2025, 45 devices belonging to the Al Jazeera broadcaster were targeted by zero-click attacks delivered through ads, according to Citizen Lab's analysis. The infected devices made contact with domains linked to Discover-Tech and then connected to infrastructure associated with Candiru.

Al Jazeera took part in the investigation, sharing network logs of the devices with the researchers. It was exactly this material that made it possible to reconstruct the attack chain: without corporate network monitoring, episodes like this tend to go unnoticed.

The network logs from Al Jazeera were key in understanding the ad-based nature of that attack. If a user's personal device were targeted, say, while they were connected to their home Wi-Fi or mobile data, there's not going to be the same level of network monitoring there. So I think the lack of prior reporting is probably mainly a visibility issue: Defenders have to be in the right place at the right time, looking at the right data.

Bill Marczak, senior researcher at Citizen Lab

The research also identified Discover-Tech ad impressions on networks linked to NATO and the United Nations, in legislative bodies in Europe, in critical infrastructure providers in Australia, and in the armed forces and government agencies of Norway and Sweden. Not all of the firm's ads were necessarily weaponized to distribute spyware, but the reach of the network is what worries the researchers.

The ad tech industry's response

Following the joint investigation by Citizen Lab with cybersecurity firm Confiant, three key players in the advertising chain took action:

• Google ended Discover-Tech's registration on its ad platforms and began displaying Safe Browsing warnings for sites linked to the group.
• IAB Europe, the entity that maintains the global ad tech vendor list (GVL), suspended Discover-Tech after a policy audit.
• Beeswax, Comcast's programmatic advertising platform, removed Discover-Tech from its network after independent validation by a third-party security specialist.

Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies. We also set up Safe Browsing warnings to help protect people if they navigate to websites linked to this group.

Google spokesperson

Discover-Tech and its CEO did not respond to Wired's requests for comment. Integrity Partners, which is believed to control Candiru's assets since the company was sanctioned by the U.S. government in 2021, also did not respond.

What changes for those who build apps and integrate ad SDKs

In short: if your app monetizes with third-party ads, it is, by definition, an attack surface you don't fully control. AdFection exposes a structural blind spot: the ad SDK runs inside your process, with access to the WebView and, in many cases, broad system permissions, and you normally don't audit the code it loads at runtime.

Some practical points that the discovery raises for mobile and product teams in Brazil:

• Vetting ad tech vendors isn't a checklist, it's a continuous process. Discover-Tech was registered on legitimate platforms like Google Ads and IAB Europe before being suspended; relying on prior certification isn't enough.
• Isolate ad rendering. Running ad WebViews in a separate process, with minimal permissions, reduces the blast radius if an SDK is compromised.
• Monitor ad SDK network traffic in production, not just in test environments, since malicious behavior can be targeted at specific victims and never show up in QA.
• Review Content Security Policy and sandboxing in hybrid apps or those with embedded WebViews, where ad scripts have more freedom to execute.

The ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem, and is perfectly suited to the mercenary spyware industry. Until this architecture changes, or ad companies get serious about customer vetting, we're going to keep seeing this kind of abuse.

Bill Marczak, senior researcher at Citizen Lab

For the end user, the researchers' own recommendation is limited: aggressively blocking ads on all sites and platforms is, today, the only practical defense against a vector that doesn't depend on a click.

What remains unclear

Jason Kint, CEO of digital media trade group Digital Content Next, sums up the risk more broadly:

Although rare and sophisticated, I wouldn't be entirely surprised to learn about zero-click attacks through ads. Anything that goes directly against users' expectations or lowers the trust in the open web is deeply concerning.

Jason Kint, CEO of Digital Content Next

The case also doesn't clarify whether other countries or Brazilian programmatic bidding platforms have already had impressions linked to Discover-Tech, since Citizen Lab's analysis focused on government networks and critical infrastructure in Europe, Australia, Norway, and Sweden. For those who develop or integrate monetization SDKs in Brazil, the episode serves as a warning that the ad vendor chain needs to go through the same security review process as any other third-party dependency in the app.