Citizen Lab discloses AdFection attack: zero-click spyware infects phones via targeted ads

The University of Toronto's Citizen Lab disclosed an attack campaign named AdFection, where spyware silently infects devices through targeted ads while users browse apps or web pages. Between 2024 and 2025, Citizen Lab determined that 45 devices at Al Jazeera were compromised by zero-click attacks delivered via ads, with the related targeted ads served by the Israeli marketing company Discover-Tech, and the spyware attributed to Israeli developer Candiru. After a joint investigation with Citizen Lab and security firm Confiant, Google banned Discover-Tech's ad platform and set Safe Browsing warnings, and IAB Europe also suspended its eligibility in the global vendor list GVL. Researchers estimate that millions of devices were directed to Candiru servers, and from March to June this year, related ads appeared in over 70,000 mobile apps and 120,000 websites.