Can targeted ads silently install spyware on your devices?
Researchers found mercenary spyware delivered via digital advertising, requiring no user interaction to compromise devices.
Key points
- Citizen Lab identified a campaign called AdFection using zero-click ads to install spyware.
- The attack vector links an Israeli ad firm to servers associated with the Candiru spyware developer.
- Dozens of devices, including those belonging to Al Jazeera, were targeted during 2024 and 2025.
The short version
- Sophisticated spyware is being distributed through online advertising infrastructure without user interaction.
- The campaign, dubbed AdFection, merges zero-click exploitation techniques with the ad ecosystem.
- Targets included devices used by staff at the news outlet Al Jazeera.
The details
Researchers at The Citizen Lab at the University of Toronto released technical evidence of a spyware campaign distributed via targeted online ads on Thursday. Dubbed AdFection, the operation allegedly involved an Israeli-registered advertising firm connected to servers linked to a spyware company. The researchers documented how dozens of devices were infected with invasive malware as users browsed the internet or used apps.
This marks the first detailed public technical evidence of sophisticated spyware infecting devices through digital advertisements. The attack method merges rare zero-click exploitation with the sprawling online ad infrastructure. Victims do not need to click anything or make a misstep for the malware to install automatically.
The context
Zero-click hacks are considered a holy grail for attackers because they bypass user interaction entirely. Previously, such attacks often exploited vulnerabilities in mobile messaging or communication applications. However, this campaign demonstrates the use of the ad ecosystem to distribute malware, sometimes with little to no interaction required from the victim.
The targeted ads were issued by Discover-Tech, an Israeli-founded marketing firm. The spyware installed was attributed to Candiru, an Israeli developer. During 2024 and 2025, Citizen Lab concluded that 45 devices belonging to Al Jazeera were targeted with these zero-click ad-based attacks.
Next steps
The researchers note that there is little individuals can do to protect themselves from zero-click ad attacks other than blocking ads thoroughly on all websites and platforms. Intelligence agencies such as the NSA and CIA are aware of this risk. Wolfie Christl, a senior researcher at Citizen Lab, described the risk of infection simply by using a website or app that displays ads as a nightmare scenario.
What defenders should look for
Security operations teams should monitor for anomalous network connections originating from web browsers or common applications, particularly those linking to known advertising infrastructure or unexpected external IPs. Look for unexpected process spawns or privilege escalations that occur without corresponding user input.
Check whether endpoints exhibit signs of resource usage spikes during idle periods. Investigate any new outbound connections to domains associated with ad networks that do not align with standard browsing patterns. Containment moves should include isolating affected hosts from the network to prevent data exfiltration and preserving volatile memory for forensic analysis before rebooting.
What to do and how to stay safe: Citizen Lab
- Enable strict ad-blocking extensions on all corporate browsers and mobile devices to reduce exposure to malicious ad payloads.
- Monitor network traffic for unexpected connections to advertising domains or known spyware infrastructure.
- Restrict browser permissions and sandboxing capabilities to limit the damage potential of any executed code.
- Review endpoint logs for unexplained process executions or privilege changes that occur without user interaction.
Step-by-step guide: Immutable Backups: Stop Ransomware Deleting Your Data Copies
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is a spyware campaign that uses targeted online ads to silently infect devices with mercenary spyware without requiring user interaction.
Which organizations were targeted?
Researchers concluded that 45 devices belonging to the news outlet Al Jazeera were targeted with these attacks during 2024 and 2025.
Who developed the spyware?
The spyware is attributed to the Israeli developer Candiru, with ads issued by the marketing firm Discover-Tech.
