Citizen Lab reveals zero-click spyware distributed via targeted online ads

Researchers at The Citizen Lab announced on Thursday that they have uncovered technical evidence of sophisticated spyware being distributed through online advertising networks. This campaign, which they named AdFection, allows attackers to silently infect devices as users browse the internet or use applications. The findings represent the first public release of detailed technical data showing this specific vector for mercenary spyware distribution.

The attacks exploit the infrastructure of the online ad ecosystem to deliver malware without requiring any action from the victim. According to the report in WIRED Security, the spyware is attributed to the Israeli developer Candiru. The advertising firm allegedly responsible for issuing the targeted ads is Discover-Tech, an Israeli-founded marketing company. Evidence of this campaign shows the merging of zero-click spyware with digital ad distribution, underscoring the urgency of the risk.

How the AdFection campaign works

Zero-click hacks remain a primary objective for advanced attackers because they install malware without the target clicking a link or opening a file. Traditionally, these rare exploits have targeted vulnerabilities in mobile messaging and communication applications. However, attackers have also exploited the sprawling infrastructure of the online ad ecosystem to distribute malware, sometimes with little or no interaction needed from victims. Bill Marczak, a senior researcher at Citizen Lab, stated that operators can automatically hack specific individuals as they use apps or browse the web.

The stealth of the attack means victims typically see no signs of compromise. Marczak noted that someone infected in this manner would not notice anything unusual on their device. In many cases, the target might not even see the specific advertisement that triggered the infection. This lack of visible indicators makes detection extremely difficult for both individual users and organizational security teams.

Who is affected by these attacks

During 2024 and 2025, Citizen Lab concluded that 45 devices belonging to the news outlet Al

What to do and how to stay safe

• EDR tools record process lineage to show how one program spawned another, revealing hidden persistence mechanisms.
• False positives increase significantly when EDR agents scan complex development environments or virtualization software.
• Incident responders use EDR data to map lateral movement, identifying which accounts were compromised after initial access.

Endpoint detection and response transforms raw endpoint data into actionable intelligence by tracking behavior rather than just signatures. Configure your agents to monitor critical processes and test your detection rules regularly to ensure they catch evolving threats.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.