AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware
Points and comments are a snapshot, not live.
Citizen Lab exposes a zero-click spyware attack delivered via targeted ads from an Israeli company.
Citizen Lab's report provides the first technical confirmation of a zero-click mercenary spyware attack delivered via targeted online advertisements, which they call AdFection. The Israeli company Discover-Tech operated a platform called Controlium that enabled mercenary spyware partners to de-anonymize, fingerprint, and automatically infect devices when an ad was rendered. Devices at Al Jazeera were infected with Candiru's spyware. Discover-Tech's ads appeared in nearly 200,000 apps and websites. Google and IAB Europe removed Discover-Tech from their ad vendor registries after the investigation, and Google terminated its access to its ad exchange platforms.
What commenters are saying
Commenters discussed the technical mechanisms of the attack, expressing surprise that ads can contain executable JavaScript code. Many recommended using ad blockers (uBlock Origin, wBlock) and DNS-based blockers (NextDNS) as protection, especially on mobile. Some questioned whether ad blockers would protect against in-app ads. A few pointed out the scale and auditing failures, noting that the ad infrastructure allowed code execution without content disarm. Another commenter noted that Israel's Unit 8200 alumni working at major tech companies raised security concerns.