Readers who rely on ad-supported sites and apps now have a clear reason to revisit how those ads reach them. A Citizen Lab report has documented a new spyware family, dubbed AdFection, that infects phones and computers through routine online advertising, with no link click or file download required from the victim.
The report is the first documented case of a zero-click, government-backed spyware attack delivered through commercial ad networks. The Israeli firm Discover-Tech reportedly built the ad-infiltrating technology and posed as a legitimate advertising vendor, winning placements on mainstream sites and mobile apps. Once inside the real-time bidding system that decides which ad loads on a given screen, the operation could profile and de-anonymize specific users, then push malware hidden inside an ordinary-looking ad creative.
How AdFection reaches a device
Online advertising runs on automated, real-time bidding auctions. Every time a page or app loads, advertisers compete in milliseconds to serve an ad to that specific user. Discover-Tech’s software entered that pipeline as a vendor, which gave it the same trusted path that any other advertiser uses to reach major publishers.
Citizen Lab’s analysis says the campaign displayed roughly 442 million ads across more than 120,000 websites and apps, including the BBC and the New York Times, along with mobile apps such as Duolingo, Badoo and Grindr. The ads were rendered on devices used by militaries, governments, critical infrastructure operators and national cyber agencies. Because the malicious payload is delivered through the ad slot itself, a user browsing an otherwise trustworthy site can be infected without any interaction.
Who was targeted
Citizen Lab identifies journalists and staff at Al Jazeera, along with officials and employees at organizations including NATO, the European Commission, NVIDIA and Arm, as having been targeted through this pipeline. The targets reflect the kind of high-value users that government clients typically want to reach, and they show how a compromised ad network can quietly extend surveillance reach into sensitive environments.
The vendor behind the ads
Discover-Tech presented itself as a legitimate ad firm while acting as what Citizen Lab describes as a bridge between ad vendors and the mercenary spyware ecosystem. Researchers also found login records on Discover-Tech’s infrastructure tied to employees of the spyware maker Candiru, suggesting overlap between the two operations.
Google confirmed it has now removed Discover-Tech from its ad platforms following a joint investigation with Citizen Lab and Confiant, citing systematic policy violations. Other major ad platforms implicated in the report have not been publicly named as taking similar action.
Why ad networks are an attractive spyware channel
Programmatic advertising delivers tailored messages to specific users at scale, running on sites most people already trust. That combination of broad reach, ad-level targeting, and the implicit trust many users place in established sites makes programmatic advertising useful for state-aligned spyware operators who want to compromise targets without relying on phishing or exploit-laden links.
Citizen Lab’s broader point is that AdFection is unlikely to be an isolated case. The advertising ecosystem offers spyware vendors a turnkey way to reach politically and diplomatically sensitive targets on devices they already use every day, which means similar pipelines are likely being explored beyond this one vendor.
What readers and organizations can do
Citizen Lab’s guidance for anyone who could be targeted based on their role, including journalists, activists, government staff and corporate security teams, is to disable ad tracking on their devices and to consider blocking ads altogether. For organizations, the practical takeaway is that ad inventory on trusted news and app properties is now a confirmed spyware delivery surface, and that security reviews should treat third-party ad vendors as part of the supply chain.
For security teams that need to see how their own properties render third-party ads and scripts, SEOScanPro’s GEO Grids and site audit surfaces the third-party calls a page actually loads, including the ad tech vendors in the bidding path.
FAQ
What is AdFection spyware?
AdFection is the name Citizen Lab gave to a spyware delivery method that infects phones and computers through online advertising, without requiring the victim to click a link or open a file. Citizen Lab’s report describes it as the first documented zero-click, government-backed spyware attack delivered through commercial ad networks.
Who is behind AdFection?
Citizen Lab attributes the ad-infiltrating technology to an Israeli company called Discover-Tech, which it says presented itself as a legitimate advertising firm while serving as a bridge between ad vendors and mercenary spyware. Researchers also found login records on Discover-Tech’s infrastructure tied to employees of the spyware maker Candiru.
Has Google responded to the AdFection report?
Google has suspended Discover-Tech from its ad platforms following a joint investigation with Citizen Lab and Confiant, citing systematic policy violations. Other ad platforms named in the report have not been publicly identified as taking similar action.