Citizen Lab discloses AdFection, an ad-delivered zero-click spyware
Start here
多伦多大学 Citizen Lab 披露名为 AdFection 的攻击活动:间谍软件通过定向广告在用户浏览应用或网页时静默感染设备,无需点击或任何操作。2024 至 2025 年间,Citizen Lab 判定半岛电视台至少 45 台设备遭到与以色列间谍软件厂商 Candiru 关联的零点击攻击,相关广告由以色列公司 Discover-Tech 投放。研究称 Discover-Tech 以合法广告商身份运作,其 Controlium 平台可在广告渲染时对特定用户去匿名化、做设备指纹识别并下发代码,广告本身不含恶意内容,投放它的广告网络没有可检测的东西。约 40 亿条竞价记录显示其广告在四个月内把数百万台设备引向 Candiru 服务器。Citizen Lab 还称澳大利亚核科学与技术组织(ANSTO)及其他澳大利亚政府、关键基础设施和媒体网络出现在受影响名单中。Google 在与 Citizen Lab 及安全公司 Confiant 联合调查后封禁了相关广告。美国参议员 Wyden 与 Booker 随后称定向广告构成安全风险、行业须改革,IAB Europe 反驳称报告未证明基础设施失灵;报告呼吁监管机构调查 Discover-Tech 与 Candiru。
Generated by AI from reports · Updated 6 days ago
Latest developments
Progress timeline
- CyberScoopUS senators say targeted advertising poses a security risk; advertising industry group says the criticism is misplaced
US Senators Wyden and Booker said that the AdFection technique disclosed by Citizen Lab last week delivered mercenary spyware via zero-click delivery through targeted advertising, and that the industry must reform; IAB Europe rebutted that the report did not prove infrastructure failure. Discover-Tech, most associated with the attack, has been banned by Google and others. The report calls on regulators to investigate Discover-Tech and spyware company Candiru.
- WebAxios· Media coverageHackers are turning web browsing into a spyware trap(opens the original post in a new tab)
- ABC NewsAustralian nuclear agency targeted by ad-delivered zero-click spyware
A report by Citizen Lab, a research group at the University of Toronto, says an Israel-based company used online advertising technology to deliver zero-click commercial spyware to millions of devices, and that the Australian Nuclear Science and Technology Organisation (ANSTO) and other Australian government, critical infrastructure and media networks appear on the list of those affected. The report attributes the campaign to Discover-Tech, saying it bid on advertising platforms such as Google and placed ads that looked normal but carried code that could install a backdoor on devices and obtain passwords, emails and internal system information. Citizen Lab said it traced the process on an Al Jazeera device from seeing an infected ad to contacting its servers to files being loaded onto the computer, and noted that merely viewing an ad does not guarantee a device is successfully infected. ANSTO said it had found no impact on its facilities, systems or information; Google removed Discover-Tech from its platform after researchers notified it.
- Hacker NewsHacker News· DiscussionZero-Click Spyware Is Infecting Phones via Targeted Ads(opens the original post in a new tab)
- WebBleepingComputer· Media coverageTargeted ads installed Candiru spyware in zero-click attacks(opens the original post in a new tab)
- The Hacker NewsCitizen Lab traces Al Jazeera zero-click Candiru spyware infections to targeted online ads
Citizen Lab says Israeli spyware vendor Candiru infected Al Jazeera devices through ordinary online ads, with the attack requiring no user click or any action, and at least 45 devices targeted between 2024 and 2025. Researchers say the ads were placed by Discover-Tech, which describes itself as a digital advertising company; when an ad loads, the device's advertising ID and network address are sent back to its server, which determines whether the device is a target and whether to deliver attack code. The ad itself contains no malicious content, so the ad networks that served it had nothing detectable. They recovered a spyware sample from one device whose code techniques match the Candiru tool dismantled in 2021, and on that basis linked it to Candiru with high confidence; the research does not say which government was responsible. Google and IAB Europe removed Discover-Tech from vendor lists in early October, Google cut off its ad exchange access, Beeswax removed it, and Vungle suspended its access pending review.
- WIRED Security and AICitizen Lab discloses AdFection attack: zero-click spyware infects phones via targeted ads
The University of Toronto's Citizen Lab disclosed an attack campaign named AdFection, where spyware silently infects devices through targeted ads while users browse apps or web pages. Between 2024 and 2025, Citizen Lab determined that 45 devices at Al Jazeera were compromised by zero-click attacks delivered via ads, with the related targeted ads served by the Israeli marketing company Discover-Tech, and the spyware attributed to Israeli developer Candiru. After a joint investigation with Citizen Lab and security firm Confiant, Google banned Discover-Tech's ad platform and set Safe Browsing warnings, and IAB Europe also suspended its eligibility in the global vendor list GVL. Researchers estimate that millions of devices were directed to Candiru servers, and from March to June this year, related ads appeared in over 70,000 mobile apps and 120,000 websites.
- CyberScoopAdFection: how mercenary spyware compromises victims' devices through targeted ads
The University of Toronto's Citizen Lab has disclosed a zero-click spyware delivery method called AdFection, in which attackers use targeted ads to make devices automatically connect to mercenary spyware servers such as Candiru. Citizen Lab says the Israeli company Discover-Tech, ostensibly an advertising firm, actually facilitates several mercenary spyware partners, including Candiru, and that its ads directed millions of devices to Candiru servers, possibly for large-scale tracking and surveillance. The research says at least 45 devices at Al Jazeera were hit by zero-click attacks linked to Candiru, and that between March and June this year Discover-Tech's ads appeared on more than 120,000 websites and more than 70,000 mobile apps; according to an investigation by ad security company Confiant, the ads also appeared on networks including the U.S. Department of Defense, NATO, and the International Atomic Energy Agency.
- Date not givenThe Citizen LabSelectedExposing AdFection: How Discover-Tech turned targeted advertising into a delivery pipeline for zero-click mercenary spyware
Citizen Lab published an investigation report stating that between 2024 and 2025, at least 45 devices of the international news organization Al Jazeera were infected through targeted advertising with zero-click mercenary spyware linked to Candiru, and the research team named this technique AdFection. The report states that the Israeli company Discover-Tech operated as a legitimate advertiser, and its Controlium platform could de-anonymize specific users at ad render time, perform device fingerprinting and deliver code. About 4 billion bid records show that its ads appeared on nearly 200,000 websites and Android/iOS apps over four months. Google and IAB Europe have removed Discover-Tech from their ad vendor lists, and Google terminated its access to its ad exchange.
Related discussion
- Older than 72 hours · Not included in the 72-hour figures
- X@HypePakistan · Hype PakistanA disturbing new cybersecurity threat has been uncovered. 📱 Citizen Lab found that Israeli corporate network Discover…(opens the original post in a new tab)
- X@TweetThreatNews · Cybersecurity News EverydayA Citizen Lab–Confiant report says targeted ads in the AdFection technique delivered zero-click mercenary spyware, incl…(opens the original post in a new tab)
- X@2Workly · 2WorklyCandiru delivered zero-click spyware through ad networks via Discover-Tech. Treat ad exchanges as untrusted code delive…(opens the original post in a new tab)
- X@cyber_rekk · Mololuwa | Cybersecurity - (The God Complex)An ad appearing on your phone can be enough to infect it with spyware You don't have to click it, download anything or…(opens the original post in a new tab)
- X@Komodosec · Komodo Cyber SecurityExposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware citizenlab.…(opens the original post in a new tab)
- X@ptdbugs · dbugsADINT on a global scale Read on dbugs: https://dbu.gs/news/adint-on-a-global-scale-20261023 Researchers from Citizen…(opens the original post in a new tab)
- X@Darwindwpqs · DarwinResearchers from Citizen Lab and Confiant have exposed the "AdFection" campaign, which used Israeli ad firm Discover-Te…(opens the original post in a new tab)
- X@ProPakTech · Tech & Telecom by ProPakistaniThe research links Israeli firm Discover-Tech's advertising system to spyware developed by Candiru, now known as Integr…(opens the original post in a new tab)
1 comments·Oct 25 22:33Collect
- X@ProPakTech · Tech & Telecom by ProPakistaniA no-click spyware delivery technique dubbed AdFection was linked to 139 million ad bids in Pakistan, placing the count…(opens the original post in a new tab)
1 comments·Oct 25 22:33Collect
- X@Donuncutschweiz · DonEin Forschungsbericht von Citizen Lab legt offen, wie tief sich kommerzielle Überwachung in die globale Werbeinfrastruk…(opens the original post in a new tab)
7 likes·Oct 23 16:38Collect
- WebAxiosHackers are turning web browsing into a spyware trap(opens the original post in a new tab)
- X@tomrohde · Thomas Rohde“Exposing AdFection How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware” https://ci…(opens the original post in a new tab)
Attention trend
New sources per day
- Oct 17: 26 new sources (1 outlets, 25 accounts)
- Oct 18: 21 new sources (0 outlets, 21 accounts)
- Oct 19: 12 new sources (2 outlets, 10 accounts)
- Oct 20: 8 new sources (0 outlets, 8 accounts)
- Oct 21: 1 new sources (0 outlets, 1 accounts)
- Oct 22: 5 new sources (1 outlets, 4 accounts)
- Oct 23: 4 new sources (0 outlets, 4 accounts)
- Oct 24: 1 new sources (0 outlets, 1 accounts)
- Oct 25: 0 new sources (0 outlets, 0 accounts)
- Oct 26: 0 new sources (0 outlets, 0 accounts)
- Oct 27: 0 new sources (0 outlets, 0 accounts)
- Oct 28: 0 new sources (0 outlets, 0 accounts)
- Oct 29: 0 new sources (0 outlets, 0 accounts)
- Oct 30: 0 new sources (0 outlets, 0 accounts)