«Nightmare Scenario»: Zero-click spyware infects phones through targeted advertising

Researchers at Citizen Lab have published, for the first time, technical evidence of sophisticated mercenary spyware being distributed through online advertisements.

Dubbing the attacks "AdFection," the researchers documented a campaign in which an Israeli-registered ad company apparently connected to servers associated with a spyware company and infected dozens of devices with its invasive malware. Citizen Lab believes this is the first detailed technical evidence that has been made publicly available through digital advertisements of sophisticated spyware infecting devices.

Zero-click hacks are a holy grail for attackers and a disaster for victims, as they can automatically install malware on devices without requiring any interaction or mistake from the target. When sophisticated hackers have carried out rare zero-click attacks in recent years, they have often exploited vulnerabilities in mobile messaging and communication apps to infect victims. But attackers have also exploited the vast infrastructure of the online advertising ecosystem to distribute malware, sometimes without the need for victim interaction. Evidence from the ZeroClick spyware campaign uncovered by Citizen Labs researchers shows the merging of the two threats and underscores the scope and urgency of the threat.

"AdFection allows operators to automatically hack certain people with mercenary spyware when they use apps or browse the Internet," said Bill Marczak, senior researcher at Citizen Lab. "Someone who gets hacked like this won't see anything bad. In fact, they might not even see any ads at all."

He notes that the situation is particularly concerning because there isn't much people can do to protect themselves from zero-click ad attacks other than to completely block ads on all websites and platforms — a fact that intelligence agencies like the NSA and CIA seem to be well aware of.

"The risk of infecting your device with spyware simply by using a website or app that displays ads is a nightmare scenario," says Wolfie Christl, senior researcher at Citizen Lab.

During 2024 and 2025, Citizen Lab concluded that 45 devices belonging to the Al Jazeera news network were targeted with ad-served zero-click attacks. Researchers say the targeted ads were published by Israeli-founded marketing firm Discover-Tech and distributed spyware attributed to Israeli developer Candiru. According to Citizen Lab's analysis, the infected devices were in contact with domains associated with Discover-Tech and then with infrastructure associated with Candiru. (Al-Jazeera, which participated in this research and shared the device's reports with the researchers of the Citizen Lab, did not respond to a request for comment.)

"The ability to deliver personalized and tailored content to specific users is a hallmark of the modern online advertising ecosystem and is perfectly suited to the mercenary spyware industry," says Marczak. Until this architecture changes, or until advertising companies get serious about customer reviews, we will continue to see this type of abuse.

Emails and messages sent by WIRED to Discover-Tech and its CEO went unanswered prior to publication. Integrity Partners, which is believed to own Condiro's assets after the US government imposed sanctions in 2021, also did not respond to requests for comment.

Google, which runs one of the world's largest advertising businesses, terminated Discover-Tech's registration after working with Citizen Lab and researchers at cybersecurity firm Confiant and confirming the spyware link. "Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our advertising platforms for systematic violations of our policies," a Google spokesperson said. "We also set up Safe Browsing alerts to protect people when they go to websites associated with this group."

The European branch of the Interactive Advertising Bureau (IAB), an advertising industry body, confirmed to WIRED that it has suspended Discover-Tech from its global vendor list, known as GVL. The company says it was suspended after an audit of its policies by IAB Europe. "Further confirmation of spyware findings could also justify outright expulsion from GVL," says a spokesperson for IAB Europe.

A spokesperson for Beeswax, an online advertising industry company owned by Comcast, said in a statement: "Beeswax removed Discovery-Tech from our platform following recent activity and independent verification by a third-party security expert. We maintain a zero-tolerance policy for malicious advertising."

Often when you see ads online or in apps, they're being served through a complicated process called real-time bidding — basically an automated auction where advertisers bid to show you specific ads. This millisecond-long process can result in advertisers collecting massive amounts of data about your device, location, and browsing history, among other things. The process has been a privacy nightmare for years, as shady data brokers sell people's personal information and law enforcement agencies and hostile nations buy it to track or target people.

Researchers at Citizen Labs say Discover-Tech operates an ad platform called Controlium that can allow its users to "auto-anonymize, fingerprint, and infect devices" after an ad is served. Overall, the researchers estimate that millions of devices were routed to Candiru's servers, where they could be profiled. Citizen Lab researchers say that by analyzing ad serving records publicly available on the Discover-Tech website, ads linked to the company with offensive script tags were shown on more than 70,000 mobile apps and more than 120,000 websites between March and June of this year. According to researchers, several apps display more than a million Discover-Tech-related ads.

The company's ads weren't necessarily weaponized for the potential distribution of spyware, but researchers say they've generally seen Discover-Tech ads on government and national security-related networks around the world. These include NATO and UN networks, as well as regulatory bodies in Europe, critical infrastructure providers in Australia, plus armed forces and government agencies in Norway and Sweden.

Previous zero-click targeted ad campaigns that distributed spyware rarely surfaced publicly, but Citizen Lab researchers say this is likely a sign of the widespread trust of advertising infrastructure, embedded in all aspects of digital life without specific oversight.

Al Jazeera's reports were key in understanding the propaganda-based nature of that attack, Marczak says. If the user's personal device is targeted, say while connected to their home Wi-Fi or mobile data, there won't be a layer of network monitoring there. "So I think the lack of prior reporting is probably mostly an visibility problem: advocates need to be in the right place at the right time, looking at the right data."

Jason Kent, CEO of digital media trade organization Digital Content Next (of which WIRED's parent company Condé Nast is a member), says that these types of attacks are both acceptable and damaging, about the threats that can come from the pervasiveness of the digital advertising ecosystem.

"Although it's rare and sophisticated, I wouldn't be entirely surprised to learn about zero-click attacks through advertising," says Kent. "Anything that goes directly against user expectations or undermines trust in the open web is deeply troubling."