Threats · 5h ago
Citizen Lab said Thursday it found AdFection, the first detailed case of zero-click spyware delivered through targeted advertising, and tied the campaign to Discover-Tech and Candiru. The ads covertly sent devices to Candiru servers, and Citizen Lab said infections showed up on sensitive networks, including media and government-related environments.
The mechanism is not a fake login page or a user click. Ordinary ad traffic was used as the delivery path, so the ad stack itself became the redirect layer that steered devices toward spyware infrastructure in the background. That breaks the usual assumption that ads are just content.
For organizations that buy, serve, or inspect third-party ads, the exposure sits in the ad supply chain itself: blocking obvious phishing does not cover this path, and any network that treats ad traffic as non-executable can inherit a surveillance gateway it never chose.
3 sources covering this story
Targeted ads delivered 0-click exploits to install mercenary malware
The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads.
Spyware vendors found a way to make targeted ads even worse
Israeli adtech outfit allegedly helped spyware vendors infect phones while enjoying Google's seal of approval
AdFection: How mercenary spyware invades victims’ devices through targeted advertising
Researchers say the attacks have serious implications for the online advertising world, and regulators.
Part of the PlainSec briefing for 2026-10-15