Citizen Lab has publicly confirmed for the first time that targeted advertising can be used as a delivery channel for zero-click spyware.
The technique is called AdFection: Candiru commercial spyware is embedded in targeted ads, and infection is complete as soon as the target device loads one—no click or installation required. Known victims include Al Jazeera journalists. The company behind the ad campaign is called Discover-Tech.
The attacks take place within the real-time bidding chain. Ad code itself runs in apps and browsers, and every layer—from DSPs to SSPs—offers an opportunity to insert or replace content. Targeted delivery can also help attackers filter out irrelevant devices, showing the spyware only to people in specific regions or with particular language settings or interest tags. The smaller the exposure, the harder it is to trace the attack afterward.
What ordinary device users can do is reduce the amount of information about themselves that enters the bidding pool: install only essential apps and turn off unnecessary advertising identifiers. A more practical rule of thumb: if a journalist, lawyer, or activist you know experiences a sudden leak of their contacts, treat it as a security incident rather than a phone malfunction.
Citizen Lab's report includes a list of IoCs that can be checked one by one to see whether a device was affected. A single infection can be difficult to assess, but bringing together ad delivery records, device logs, and unusual activity involving contacts can provide a more complete picture.
The technique is called AdFection: Candiru commercial spyware is embedded in targeted ads, and infection is complete as soon as the target device loads one—no click or installation required. Known victims include Al Jazeera journalists. The company behind the ad campaign is called Discover-Tech.
The attacks take place within the real-time bidding chain. Ad code itself runs in apps and browsers, and every layer—from DSPs to SSPs—offers an opportunity to insert or replace content. Targeted delivery can also help attackers filter out irrelevant devices, showing the spyware only to people in specific regions or with particular language settings or interest tags. The smaller the exposure, the harder it is to trace the attack afterward.
What ordinary device users can do is reduce the amount of information about themselves that enters the bidding pool: install only essential apps and turn off unnecessary advertising identifiers. A more practical rule of thumb: if a journalist, lawyer, or activist you know experiences a sudden leak of their contacts, treat it as a security incident rather than a phone malfunction.
Citizen Lab's report includes a list of IoCs that can be checked one by one to see whether a device was affected. A single infection can be difficult to assess, but bringing together ad delivery records, device logs, and unusual activity involving contacts can provide a more complete picture.