Zero-Click Spyware Delivered via Targeted Ads: AdFection

Researchers discovered AdFection, a zero-click spyware attack delivered through targeted online advertisements that infected devices at Al Jazeera using Candiru mercenary spyware. The Israeli company Discover-Tech orchestrated the campaign through its Controlium platform, which enables de-anonymization and automatic device infection when ads are displayed, reaching nearly 200,000 websites across dozens of countries over four months. The findings reveal structural vulnerabilities in the online advertising system, as Discover-Tech operated as a certified vendor for major platforms including Google and IAB Europe while facilitating multiple mercenary spyware partners.