Ads Deliver Spyware Without User Interaction

Researchers at the University of Toronto’s Citizen Lab, together with cybersecurity firm Confiant, exposed a new zero‑click spyware attack that spreads through targeted online ads. The team dubbed the technique “AdFection” and traced it to the Israeli advertising company Discover‑Tech, whose platform lets partners, including the spyware vendor Candiru, deliver malicious code to devices when an ad is displayed. The researchers found the ads had appeared on nearly 200,000 websites and apps in dozens of countries, and that dozens of Al Jazeera devices were compromised.

How the attack works

Once a user opens a web page or app, a bid request is sent to an ad exchange and Discover‑Tech’s ad may win. The ad is then rendered on the device, often invisibly, and it sends the device’s advertising ID and IP address back to Discover‑Tech’s servers. If the target is selected, the ad triggers code that contacts Candiru’s servers and installs spyware in the browser or app without any click. The malware runs silently in the background.

After the findings were shared, major ad platforms such as Google and Beeswax removed Discover‑Tech’s access to their marketplaces, and Citizen Lab urged regulators in the US, Canada and Europe to investigate the loophole. The study highlighted that ad‑network certification often relies on self‑attestation, allowing a malicious actor to masquerade as a legitimate vendor. The incident shows how the unverified ad ecosystem can become a conduit for silent spyware infections, threatening critical infrastructure and national‑security networks.