That online ad you saw for earbuds, a drone or bubble gum-scented car air freshener may have been a gateway for mercenary spyware that can infect your device without you ever having to click on it.
The Citizen Lab at the University of Toronto on Thursday said it was revealing the first details of zero-click spyware being delivered through targeted advertising, which it’s calling AdFection. It concluded that while the Israeli company Discover-Tech presents itself as a legitimate advertising firm, in actuality it operates as a facilitator for multiple mercenary spyware partners, including the well-known Candiru. Its ads covertly direct millions of devices to contact Candiru’s servers.
The likely goal, according to the researchers, is large-scale tracking and surveillance, enabled by accident by major industry players like Google. The campaign led to the infection of devices at media outlet Al Jazeera, they said, but Discover-Tech’s ads have also appeared on many sensitive networks around the world, including at the U.S. Department of Defense, NATO, the International Atomic Energy Agency and world cybersecurity agencies, according to partner investigators at ad security firm Confiant.
It’s a discovery that the researchers said raises uncomfortable questions for regulators, whom The Citizen Lab said need to investigate Discover-Tech and levy sanctions, and for the online advertising industry.
“The adtech industry, the digital advertising industry, has a lot of rethinking to do to reconsider how they approach these threats of surveillance and the responsibilities that they have with the data that they collect and how it might be abused,” said Jerome Dangu, chief technology officer and co-founder of Confiant. “The industry has optimized against cyber criminals, scams and malware for profit that targets people for extracting money, but not for surveillance.”
Wolfie Cristl, senior researcher at The Citizen Lab, said it was “disastrous” that ad vendors didn’t detect the operation for years. Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024. The activities of a shadowy outfit that the researchers dubbed DARK CARTOGRAPHER, which involves Discover-Tech and other vendors — including an unnamed U.S. intelligence contractor — date back to 2019.
“Digital advertising is broken. The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike,” Cristl said. “Cybersecurity agencies, regulators and lawmakers in the U.S., Europe and other regions must urgently step in. They must investigate the involved companies and fix the systemic risks that enable malicious ad targeting.”
Earlier reports have touched on the existence of mercenary spyware that can infect users through online ads, but Thursday’s research marks the first technical demonstration of infections and distribution through targeted advertising.
The Citizen Lab can’t currently attribute the AdFection attacks to any specific party.