Citizen Lab details new spyware triggered by online advertising

What the new spyware does and who built it

Readers get a clearer picture of a threat that turns ordinary online ads into silent spyware delivery tools, without any click or interaction from the target. The findings come from a report by Citizen Lab, which documents a spyware operation called “AdFection” that infects phones and computers through global online advertising networks. The report describes AdFection as the first confirmed case of a zero-click, government-backed spyware attack delivered through online advertising.

According to the report, the technology was developed by Discover-Tech, an Israeli company that presents itself as a legitimate advertising firm. Citizen Lab describes Discover-Tech as a “bridge between ad vendors and the mercenary spyware ecosystem.” The company used the automated real-time bidding system that powers targeted online ads to profile and de-anonymize internet users, then served malicious code hidden inside ordinary-looking advertisements. Devices were compromised simply by loading the ad, with no link to click and no file to open.

Who was targeted

The report states that the operation focused on journalists and staff at the Al Jazeera news network, along with officials and employees at organizations including NATO, the European Commission, NVIDIA and Arm. Citizen Lab found that ads carrying the spyware were shown on more than 120,000 websites, including the BBC and The New York Times, as well as in mobile apps such as Duolingo, Badoo and Grindr. In total, 442 million ads were displayed through the operation, reaching devices used by militaries, governments, critical infrastructure operators and national cyber agencies.

How the advertising system was weaponized

Targeted online advertising runs on real-time bidding auctions that let advertisers compete to show ads to specific users based on profile data. That scale and precision, qualities that make the system valuable to legitimate marketers, also make it an efficient delivery mechanism for malware. Discover-Tech exploited that infrastructure to identify high-value targets and serve them malicious payloads embedded in ads. Citizen Lab also found login records on Discover-Tech’s site, including credentials belonging to employees of the spyware maker Candiru, which the report suggests points to overlap between the two operations.

Google’s response and the wider ad ecosystem

Google was among the major ad platforms whose systems were used in the campaign. Following a joint investigation with Citizen Lab and the ad security firm Confiant, Google suspended Discover-Tech from its global vendor list. The company said in a statement that it had “blocked Discover-Tech from our ad platforms for systematically violating our policies.” The action removes Discover-Tech from the supply path for ads running across Google’s network, though it does not address the broader question of how ad infrastructure can be repurposed by other actors.

What this means for high-risk users

Citizen Lab’s assessment is that the documented campaign is “surely just the tip of the iceberg,” a signal that the advertising supply chain is a viable delivery channel for state-aligned spyware. The report’s practical advice for people who may be targeted based on their role or work is to disable ad tracking on their devices or block ads entirely, cutting off the profiling and bidding path that enables this type of attack in the first place.

FAQ

What is AdFection spyware?

AdFection is the name given to a zero-click, government-backed spyware operation documented by Citizen Lab. It delivers malicious code through ordinary online ads, infecting devices without any action from the user.

Who developed the spyware and how does it spread?

Citizen Lab attributes the technology to the Israeli company Discover-Tech. The spyware spreads through global online advertising networks, exploiting the real-time bidding system used to target ads at specific users.

What action has Google taken against Discover-Tech?

Google has suspended Discover-Tech from its global vendor list after a joint investigation with Citizen Lab and Confiant, citing repeated violations of its ad platform policies.

See our editorial disclaimer for how our articles are produced.