For decades, privacy advocates have warned about the massive data collection behind targeted ads. Now, researchers have uncovered a true nightmare scenario: those same everyday ads are being used to silently deliver advanced spyware. Dubbed AdFection, this newly discovered threat uses the automated online ad ecosystem to launch zero-click attacks.
This means you don’t have to click a bad link, download a suspicious file, or even see the advertisement to get hacked. Simply opening a regular app or loading a website without a content blocker is enough for a malicious ad to quietly infect your device.
A Silent Attack
The real-world consequences of this vulnerability were exposed when researchers from The Citizen Lab uncovered a campaign targeting the international news network Al Jazeera. Between 2024 and 2025, 45 devices belonging to their staff were reportedly compromised without a single user interaction.
The attacks were allegedly traced back to Discover-Tech, an Israeli-registered marketing firm. However, rather than simply selling ad space, Discover-Tech allegedly acted as a delivery mechanism for Candiru, a notorious mercenary spyware developer.
By exploiting the fast, automated real-time bidding auctions that decide which ads are displayed, Discover-Tech’s platform could instantly fingerprint a device and silently inject the spyware the moment a rigged advertisement loaded on a target’s screen.
Exploiting the Ad Ecosystem
This campaign capitalized on the design of the digital advertising industry, which inherently permits third parties to run localized code on user devices. Discover-Tech’s platform, Controlium, pushed ad tags across more than 120,000 websites and 70,000 mobile apps over a four-month period according to the report.
This infrastructure directed millions of devices to Candiru-linked servers for profiling, generating ad impressions on networks belonging to NATO, the UN, and various government agencies.
While major ad tech providers like Google and IAB Europe have since suspended Discover-Tech, the underlying architecture remains unchanged. Because the ecosystem relies on pushing individualized tracking scripts, researchers note that comprehensive ad-blocking is currently the most effective defense against this class of attack.
A Blind Spot
While previous zero-click ad campaigns have rarely surfaced publicly, researchers suggest this is a symptom of limited visibility rather than a lack of attacks. The digital advertising infrastructure is deeply embedded in almost every aspect of online life, typically operating with minimal security oversight.
Detecting these sophisticated hacks requires defenders to monitor network traffic at exactly the right moment—a capability present in enterprise environments like Al Jazeera, but nearly impossible for average users on home Wi-Fi or mobile data. Ultimately, the ability to launch invisible, highly targeted attacks through standard ad networks not only threatens individual security but fundamentally undermines baseline trust in the open web.
The Defense
Digital advertisement has been abused in the past for malicious campaigns. From ads for fake products over links to phishing websites and malicious downloads. In all cases, the main defense is blocking ads before they can execute on the local system.
Content blockers like uBlock Origin or good integrated ones block the majority of online ads. Without ads executing, even zero-click ads have no way of executing on the local system.
However, most content blockers are limited to web browsers, with Google still refusing to allow extensions to run on Google Chrome for mobiles. A network-wide content blocker solution, either through DNS or by running network traffic through a device like a Raspberry Pi set up for that purpose do take care of that though at home at least.