# AdFection Weaponizes Online Advertising Networks for Zero-Click Spyware Deployment Citizen Lab reveals digital ads silently delivering zero-click spyware to global targets. - **Source:** [Wired](https://www.wired.com) - **Published:** 2026-10-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/f1e4632f-02c2-4fef-9ebe-7013da2fdbcc ## Covert Zero-Click Delivery Mechanism Citizen Lab uncovered a surveillance campaign dubbed AdFection that silently infects devices through digital advertising networks. Victims require zero interaction, as devices are compromised simply by loading web pages or apps displaying weaponized ads. This represents the first public technical confirmation of zero-click mercenary spyware delivered through online ad ecosystems. ## Discover-Tech Facilitates Spyware Access Israeli advertising firm Discover-Tech operated as a critical bridge linking commercial ad vendors to mercenary spyware developers. Operating its proprietary platform called Controlium, the firm enabled surveillance actors to profile internet users at scale. The infrastructure allowed operators to push targeted exploits alongside what appeared to be standard commercial advertisements. ## Infiltration of Al Jazeera Network Between 2024 and 2025, investigators confirmed that 45 Windows devices belonging to media organization Al Jazeera were targeted. Device logs revealed direct communication with Discover-Tech domains followed by connections to Candiru infrastructure. These media workstations were compromised silently through malicious code embedded within programmatic ad units without employee awareness. ## Candiru and Bindecy Integration Analysis showed that established zero-click surveillance vendors Candiru and Bindecy utilized Discover-Tech's ad infrastructure for operations. Candiru, previously subjected to United States government sanctions in 2021, used the ad network to deploy payloads capable of harvesting messages, recording calls, and activating device microphones without triggering security alerts. ## Exploiting Real-Time Bidding Auctions The campaign weaponized programmatic real-time bidding protocols, which conduct automated auctions within milliseconds to place targeted digital ads. Attackers exploited user profiling data harvested during these ad auctions to de-anonymize targets. Once an individual matched specific targeting criteria, malicious code was served directly to their connected mobile or desktop device. ## Operational Scale Across Platforms Discover-Tech served 442 million ads across more than 120,000 websites, including major outlets like the BBC and New York Times. Malicious ad delivery also extended to popular mobile applications like Duolingo, Badoo, and Grindr. Campaign activity was documented globally across multiple countries, including Brazil, Mexico, Czechia, and Yemen. ## High-Profile Institutional Targeting Exposed ad bidding records revealed that malicious units reached networks of critical global entities. Security firm Confiant identified impressions delivered within the International Atomic Energy Agency, International Criminal Court, European Commission, NATO, and United Nations. Devices associated with tech firms NVIDIA and Arm were also exposed to the infrastructure. ## Leaked Platform Credentials and Data Discover-Tech left source code exposed on login pages and maintained an unauthenticated portal hosting user credentials. Citizen Lab researchers recreated the Controlium administrative dashboard and downloaded internal login records without authentication. These records confirmed direct platform access by at least two employees of spyware developer Candiru alongside Bindecy staff. ## Ad Industry Coordinated Eviction Following collaborative investigations with Citizen Lab and Confiant, Google terminated Discover-Tech's platform registration and issued Safe Browsing warnings. Comcast-owned ad tech firm Beeswax removed the company citing zero-tolerance policies. Concurrently, Interactive Advertising Bureau Europe suspended Discover-Tech from its Global Vendor List following a comprehensive compliance audit. ## Mercenary Commercial Sector Mergers The AdFection campaign marks an operational convergence between unregulated commercial ad tech ecosystems and mercenary spyware vendors. By hijacking ad delivery rails, surveillance vendors bypass traditional app security vetting and operating system protections. This development provides nation-state actors global attack vectors using completely legitimate programmatic marketing pipelines. ## Systemic Inherent Vulnerabilities Remain The programmatic ad architecture inherently distributes unvetted, arbitrary third-party code directly into browser memory and sandboxed apps. Because real-time auctions prioritize latency and micro-targeting over code inspection, malicious payloads easily evade vetting. The global distribution of ad exchanges creates persistent blind spots across consumer and enterprise security perimeters. ## Defensive Measures and Imperatives Security researchers emphasize that comprehensive ad blocking represents the primary technical barrier against zero-click malvertising attacks. High-risk individuals, government personnel, and journalists must disable ad tracking profiles across all mobile environments. Addressing these structural surveillance vectors requires regulatory intervention and stricter vendor accountability across global advertising platforms. ## Sources covering this story - [Wired — Zero-Click Spyware Infects Mobile Devices via Targeted Digital Advertising](https://www.wired.com/story/nightmare-scenario-zero-click-spyware-is-infecting-phones-via-targeted-ads/) - [cybersecurity | TechCrunch — Governments Using Online Advertising Networks for Zero-Click Spyware Attacks](https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/) - [Hacker News — Israeli Agency Discover-Tech Linked to Zero-Click Spyware Distribution](https://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-say) - [Engadget — Citizen Lab Uncovers AdFection Zero-Click Spyware via Ad Networks](https://www.engadget.com/2287417/citizenlab-details-new-spyware-triggered-by-online-advertising/) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._