Skip to content

Translation in progress Some entries still include text in the original language.

EventPast event

Citizen Lab discloses AdFection, an ad-delivered zero-click spyware

6 reports5 reporting sourcesplus 2 outlets covering itLatest report

Start here

AI overview

多伦多大学 Citizen Lab 披露名为 AdFection 的攻击活动:间谍软件通过定向广告在用户浏览应用或网页时静默感染设备,无需点击或任何操作。2024 至 2025 年间,Citizen Lab 判定半岛电视台至少 45 台设备遭到与以色列间谍软件厂商 Candiru 关联的零点击攻击,相关广告由以色列公司 Discover-Tech 投放。研究称 Discover-Tech 以合法广告商身份运作,其 Controlium 平台可在广告渲染时对特定用户去匿名化、做设备指纹识别并下发代码,广告本身不含恶意内容,投放它的广告网络没有可检测的东西。约 40 亿条竞价记录显示其广告在四个月内把数百万台设备引向 Candiru 服务器。Citizen Lab 还称澳大利亚核科学与技术组织(ANSTO)及其他澳大利亚政府、关键基础设施和媒体网络出现在受影响名单中。Google 在与 Citizen Lab 及安全公司 Confiant 联合调查后封禁了相关广告。美国参议员 Wyden 与 Booker 随后称定向广告构成安全风险、行业须改革,IAB Europe 反驳称报告未证明基础设施失灵;报告呼吁监管机构调查 Discover-Tech 与 Candiru。

Generated by AI from reports · Updated 6 days ago

Latest developments

2 developments
  1. · 1 report
    Citizen Lab discloses spyware delivery via targeted advertising
    CyberScoop: US senators say targeted advertising poses a security risk; advertising industry group says the criticism is misplaced
  2. · 5 reports
    Citizen Lab discloses AdFection, a zero-click spyware delivered via targeted advertising
    WIRED Security and AI: Citizen Lab discloses AdFection attack: zero-click spyware infects phones via targeted ads

Progress timeline

Oct 24
  1. CyberScoop
    US senators say targeted advertising poses a security risk; advertising industry group says the criticism is misplaced

    US Senators Wyden and Booker said that the AdFection technique disclosed by Citizen Lab last week delivered mercenary spyware via zero-click delivery through targeted advertising, and that the industry must reform; IAB Europe rebutted that the report did not prove infrastructure failure. Discover-Tech, most associated with the attack, has been banned by Google and others. The report calls on regulators to investigate Discover-Tech and spyware company Candiru.

Oct 22
Oct 20
Oct 19
  1. ABC News
    Australian nuclear agency targeted by ad-delivered zero-click spyware

    A report by Citizen Lab, a research group at the University of Toronto, says an Israel-based company used online advertising technology to deliver zero-click commercial spyware to millions of devices, and that the Australian Nuclear Science and Technology Organisation (ANSTO) and other Australian government, critical infrastructure and media networks appear on the list of those affected. The report attributes the campaign to Discover-Tech, saying it bid on advertising platforms such as Google and placed ads that looked normal but carried code that could install a backdoor on devices and obtain passwords, emails and internal system information. Citizen Lab said it traced the process on an Al Jazeera device from seeing an infected ad to contacting its servers to files being loaded onto the computer, and noted that merely viewing an ad does not guarantee a device is successfully infected. ANSTO said it had found no impact on its facilities, systems or information; Google removed Discover-Tech from its platform after researchers notified it.

Oct 18
Oct 17
Oct 16
  1. The Hacker News
    Citizen Lab traces Al Jazeera zero-click Candiru spyware infections to targeted online ads

    Citizen Lab says Israeli spyware vendor Candiru infected Al Jazeera devices through ordinary online ads, with the attack requiring no user click or any action, and at least 45 devices targeted between 2024 and 2025. Researchers say the ads were placed by Discover-Tech, which describes itself as a digital advertising company; when an ad loads, the device's advertising ID and network address are sent back to its server, which determines whether the device is a target and whether to deliver attack code. The ad itself contains no malicious content, so the ad networks that served it had nothing detectable. They recovered a spyware sample from one device whose code techniques match the Candiru tool dismantled in 2021, and on that basis linked it to Candiru with high confidence; the research does not say which government was responsible. Google and IAB Europe removed Discover-Tech from vendor lists in early October, Google cut off its ad exchange access, Beeswax removed it, and Vungle suspended its access pending review.

Oct 15
  1. WIRED Security and AI
    Citizen Lab discloses AdFection attack: zero-click spyware infects phones via targeted ads

    The University of Toronto's Citizen Lab disclosed an attack campaign named AdFection, where spyware silently infects devices through targeted ads while users browse apps or web pages. Between 2024 and 2025, Citizen Lab determined that 45 devices at Al Jazeera were compromised by zero-click attacks delivered via ads, with the related targeted ads served by the Israeli marketing company Discover-Tech, and the spyware attributed to Israeli developer Candiru. After a joint investigation with Citizen Lab and security firm Confiant, Google banned Discover-Tech's ad platform and set Safe Browsing warnings, and IAB Europe also suspended its eligibility in the global vendor list GVL. Researchers estimate that millions of devices were directed to Candiru servers, and from March to June this year, related ads appeared in over 70,000 mobile apps and 120,000 websites.

  2. CyberScoop
    AdFection: how mercenary spyware compromises victims' devices through targeted ads

    The University of Toronto's Citizen Lab has disclosed a zero-click spyware delivery method called AdFection, in which attackers use targeted ads to make devices automatically connect to mercenary spyware servers such as Candiru. Citizen Lab says the Israeli company Discover-Tech, ostensibly an advertising firm, actually facilitates several mercenary spyware partners, including Candiru, and that its ads directed millions of devices to Candiru servers, possibly for large-scale tracking and surveillance. The research says at least 45 devices at Al Jazeera were hit by zero-click attacks linked to Candiru, and that between March and June this year Discover-Tech's ads appeared on more than 120,000 websites and more than 70,000 mobile apps; according to an investigation by ad security company Confiant, the ads also appeared on networks including the U.S. Department of Defense, NATO, and the International Atomic Energy Agency.

Date not provided
  1. Date not given
    The Citizen LabSelected
    Exposing AdFection: How Discover-Tech turned targeted advertising into a delivery pipeline for zero-click mercenary spyware

    Citizen Lab published an investigation report stating that between 2024 and 2025, at least 45 devices of the international news organization Al Jazeera were infected through targeted advertising with zero-click mercenary spyware linked to Candiru, and the research team named this technique AdFection. The report states that the Israeli company Discover-Tech operated as a legitimate advertiser, and its Controlium platform could de-anonymize specific users at ad render time, perform device fingerprinting and deliver code. About 4 billion bid records show that its ads appeared on nearly 200,000 websites and Android/iOS apps over four months. Google and IAB Europe have removed Discover-Tech from their ad vendor lists, and Google terminated its access to its ad exchange.

Related discussion

Total 180 items

Attention trend

New sources per day

78 in 14 days·most 26 (Oct 17)·today 0

  • Oct 17: 26 new sources (1 outlets, 25 accounts)
  • Oct 18: 21 new sources (0 outlets, 21 accounts)
  • Oct 19: 12 new sources (2 outlets, 10 accounts)
  • Oct 20: 8 new sources (0 outlets, 8 accounts)
  • Oct 21: 1 new sources (0 outlets, 1 accounts)
  • Oct 22: 5 new sources (1 outlets, 4 accounts)
  • Oct 23: 4 new sources (0 outlets, 4 accounts)
  • Oct 24: 1 new sources (0 outlets, 1 accounts)
  • Oct 25: 0 new sources (0 outlets, 0 accounts)
  • Oct 26: 0 new sources (0 outlets, 0 accounts)
  • Oct 27: 0 new sources (0 outlets, 0 accounts)
  • Oct 28: 0 new sources (0 outlets, 0 accounts)
  • Oct 29: 0 new sources (0 outlets, 0 accounts)
  • Oct 30: 0 new sources (0 outlets, 0 accounts)

Hourly attention

Current attention 47·Peak in the comparable period 57 (Oct 24 03:00)·Change over the comparable past 24 hours 0%

0204060Oct 2402:00Oct 2605:00Oct 2807:00Oct 3010:00