Researchers uncover 'AdFection' zero-click spyware campaign delivered via online ads

Cybersecurity researchers at Citizen Lab have identified a sophisticated zero-click spyware campaign dubbed 'AdFection' that infects devices through malicious online advertisements. Unlike traditional attacks, this method requires no user interaction, as the malware executes the moment an ad is served. Investigations revealed that the campaign targeted journalists, including staff at Al Jazeera, compromising devices to steal sensitive data, keystrokes, and media. The operation has been linked to two Israeli firms: Candiru, which developed the infostealer, and Discover-Tech, an ad-tech company whose infrastructure allegedly facilitated the delivery of the malware. Citizen Lab analyzed billions of ad-bidding records, discovering that Discover-Tech ads appeared on over 190,000 websites and apps. While the ultimate buyers of the spyware remain unidentified, the discovery highlights a severe vulnerability in the digital advertising ecosystem, where legitimate ad-tech platforms can be weaponized for large-scale state-sponsored surveillance.