AdFection Spyware Infects Devices Through Online Ads With No Click Required

By NewSunSEO | October 15, 2026

Reading a normal banner ad is now enough to put a government-grade surveillance implant on a phone or laptop, according to a new report from Citizen Lab. The spyware operation, called AdFection, delivers malicious code through routine online ads, with the victim doing nothing more than being shown the ad.

How AdFection turns everyday ads into spyware delivery

According to Citizen Lab’s report, Discover-Tech’s software used the advertising ecosystem to turn trusted websites and popular apps into a zero-click spyware delivery platform. Ads are normally matched to users through automated real-time bidding auctions that let advertisers compete to reach specific audiences. Citizen Lab’s report describes how the spyware maker hijacked that pipeline: instead of profiling users just to sell them things, the system profiled and de-anonymized them so it could later serve malicious malware code buried inside innocent-looking ads.

The result is the first confirmation of zero-click government-backed spyware being delivered through online ads, Citizen Lab said. Previously, similar spyware attacks typically required some form of user interaction, such as clicking a link, opening a file, or installing an application.

Who got targeted, and where the ads ran

According to the report, the spyware campaign was aimed at journalists and staff at the Al Jazeera news network, along with officials and employees at organizations including NATO, the European Commission, NVIDIA, and Arm. To reach those targets, the operation reportedly displayed 442 million ads on more than 120,000 websites, including major outlets such as the BBC and The New York Times, and inside mobile apps including Duolingo, Badoo, and Grindr.

Citizen Lab noted that the ads were shown on devices used by militaries, governments, critical infrastructure operators, and national cyber agencies. It framed the breadth of the campaign as the key reason targeted online advertising is such a desirable medium for spreading malware: it is one of the few channels that already reaches internet users globally, including sensitive environments.

How the network was exposed

Citizen Lab said login records were found on the spyware operator’s own site, including details belonging to employees of a separate spyware maker, Candiru. The presence of those internal records helped researchers connect the ad platform to the broader mercenary spyware ecosystem.

A joint investigation with the ad security firm Confiant led Google to suspend the firm from its global vendor list. Following the joint investigation with Citizen Lab and Confiant, Google said in a statement that it had blocked Discover-Tech from its ad platforms for alleged policy violations. The firm behind the spyware operation had presented itself as a legitimate advertising business, functioning as a bridge between ad vendors and the mercenary spyware ecosystem, the report stated.

What readers who may be targeted can do

Citizen Lab described the public exposure as only the start of what is likely a much larger set of abuses. The report recommended that people who could plausibly be targeted based on their identity or work, including journalists, activists, and people in sensitive government or corporate roles, disable ad tracking on their devices or block ads altogether.

For most people, the risk is low, but the report made clear that the technique is now proven in the field. If an attacker can serve malware through an ad on a major news outlet or consumer app, the defense has to happen on the device, not the screen.

FAQ

What is AdFection spyware?

AdFection is a zero-click spyware attack identified by Citizen Lab that infects phones and computers through global online advertising networks. A device can be compromised simply by receiving an ad, with no link clicks or file downloads required.

Who was behind AdFection?

Citizen Lab’s report traces the ad-infiltrating technology to an Israeli company that, according to Citizen Lab, presents itself as a legitimate advertising firm. The firm acted as a bridge between ad vendors and the mercenary spyware ecosystem.

What can individuals do about ad-delivered spyware?

Citizen Lab advises people who might be targeted based on their identity or work to disable ad tracking on their devices or block ads altogether. The organization described the discovery as likely only the beginning of a broader practice.

Related coverage

• What Zero-Click Search Means for Your Business (And the Metrics That Actually Matter)
• Zero-Click Searches Surge to 68%: How to Stay Visible