Dubbing the attacks “AdFection,” the researchers documented a campaign in which an Israeli-ed advertising firm allegedly connected to the servers linked to a spyware company and infected dozens of devices with its invasive malware. Citizen Lab believes this to be the first detailed technical evidence made publicly available of sophisticated spyware infecting devices via digital ads.

Zero-click hacks are a holy grail for attackers and catastrophic for victims, because they can automatically install malware on devices without requiring any interaction or missteps from the target. When sophisticated hackers have deployed rare zero-click attacks in recent years, they have often exploited vulnerabilities in mobile messaging and communication apps to infect victims. But attackers have also exploited the sprawling infrastructure of the online ad ecosystem to distribute malware, sometimes with little or no interaction needed from victims. Evidence of the zero-click spyware campaign that Citizen Lab’s researchers uncovered shows the two threats merging, underscoring the extent and urgency of the risk.

“AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet,” says Bill Marczak, a senior researcher at Citizen Lab. “Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all.”The situation is so concerning, he notes, because there isn’t much that people can do to protect themselves from zero-click ad attacks other than blocking ads as thoroughly as possible on all websites and platforms—a fact that intelligence agencies like the NSA and CIA seem to know all too well.

“The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario,” says Wolfie Christl, a senior Citizen Lab researcher.

During 2024 and 2025, Citizen Lab concluded that 45 devices belonging to the news outlet Al Jazeera were targeted with zero-click attacks delivered by ads. The researchers say that the targeted ads were issued by the Israeli-founded marketing firm Discover-Tech and distributed spyware attributed to the Israeli developer Candiru. Infected devices had contact with domains linked to Discover-Tech and then connected to infrastructure associated with Candiru, according to Citizen Lab’s analysis. (Al Jazeera, which participated in the investigation and shared device logs with Citizen Lab researchers, did not respond to a request for comment.)“The ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem, and is perfectly suited to the mercenary spyware industry,” Marczak says.

“Until this architecture changes, or ad companies get serious about customer vetting, we’re going to keep seeing this kind of abuse.”

Emails and messages sent to Discover-Tech and its CEO by WIRED did not receive a response before publication. Integrity Partners, which is believed to own Candiru’s assets, following sanctions by the US government in 2021, also did not respond to requests for comment.

Google, which operates one of the world’s largest advertising businesses, terminated Discover-Tech’s registration after collaborating with Citizen Lab and researchers from the cybersecurity firm Confiant and confirming a spyware link. “Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies,” a Google spokesperson says.

“We also set up Safe Browsing warnings to help protect people if they navigate to websites linked to this group.”The European branch of the Interactive Advertising Bureau (IAB), an ad industry body, confirmed to WIRED that it has suspended Discover-Tech from its global vendor list, known as the GVL. The company was suspended by IAB Europe following an audit of its policies, it says.

“Further confirmation of the findings regarding spyware could also justify a definitive expulsion from the GVL,” a spokesperson for IAB Europe says. A spokesperson for Beeswax, an online advertising industry company owned by Comcast, says in a statement: “Beeswax removed Discovery-Tech from our platform following recent activity and independent validation by a third-party security specialist. We maintain a zero-tolerance policy for malicious advertising.”

Often when you see ads online or in apps, they’re displayed following a complex process known as real-time bidding—essentially an automated auction where advertisers place bids to show you specific ads. The milliseconds-long process can result in advertisers collecting huge volumes of data about your device, your location, and browsing history, plus a whole lot more. The process has been a privacy nightmare for years, with murky data brokers selling people’s personal information, and law enforcement agencies and hostile nations buying it to track or target people.

The Citizen Lab researchers say that Discover-Tech operates an advertising platform, Controlium, that can allow its users to “de-anonymize, fingerprint, and automatically infect devices” once an ad appears. Overall, the researchers estimate that millions of devices were directed to Candiru’s servers, where they could be profiled. By analyzing ad-bidding records that were publicly exposed on the Discover-Tech website, the Citizen Lab researchers say, ads linked to the firm with attacker script tags were shown in more than 70,000 mobile apps and more than 120,000 websites between March and June this year. Multiple apps, the researchers say, displayed more than a million ads linked to Discover-Tech.

The firm’s ads weren’t necessarily all weaponized to potentially distribute spyware, but the researchers say that, in general, they have seen Discover-Tech ad impressions on government and national-security-linked networks around the world. These include NATO and United Nations networks, as well as lawmaking bodies in Europe, critical infrastructure providers in Australia, plus armed forces and government agencies in Norway and Sweden.

Previous zero-click targeted ad campaigns that distribute spyware have rarely surfaced publicly, but the Citizen Lab researchers say this is likely a symptom of ad infrastructure being so extensively trusted and incorporated in all aspects of digital life without specific oversight.

“The network logs from Al Jazeera were key in understanding the ad-based nature of that attack,” Marczak says. “If a user’s personal device were targeted, say, while they were connected to their home Wi-Fi or mobile data, there’s not going to be the same level of network monitoring there. So I think the lack of prior reporting is probably mainly a visibility issue: Defenders have to be in the right place at the right time, looking at the right data.”Speaking generally about threats that can result from the sheer ubiquity of the digital ad ecosystem, Jason Kint, CEO of the digital media trade organization Digital Content Next (WIRED parent company Condé Nast is a member), says these kinds of attacks are both plausible and damaging.

“Although rare and sophisticated, I wouldn’t be entirely surprised to learn about zero-click attacks through ads,” Kint says. “Anything that goes directly against users’ expectations or lowers the trust in the open web is deeply concerning.”