// WIRED US/UK — CYBERSECURITY
‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads
On Thursday, researchers from The Citizen Lab at the University of Toronto revealed a worst-case scenario found in the wild: spyware silently infecting targets as they browse past ads in their daily digital lives.
Dubbing the attacks “AdFection,” the researchers documented a campaign in which an Israeli-registered advertising firm allegedly connected to the servers linked to a spyware company and infected dozens of devices with its invasive malware. Citizen Lab believes this to be the first detailed technical evidence made publicly available of sophisticated spyware infecting devices via digital ads.
Zero-click hacks are a holy grail for attackers and catastrophic for victims, because they can automatically install malware on devices without requiring any interaction or missteps from the target. When sophisticated hackers have deployed rare zero-click attacks in recent years, they have often exploited vulnerabilities in mobile messaging and communication apps to infect victims. But attackers have also exploited the sprawling infrastructure of the online ad ecosystem to distribute malware, sometimes with little or no interaction needed from victims. Evidence of the zero-click spyware campaign that Citizen Lab’s researchers uncovered shows the two threats merging, underscoring the extent and urgency of the risk.
“AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet,” says Bill Marczak, a senior researcher at Citizen Lab. “Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all.”
The situation is so concerning, he notes, because there isn’t much that people can do to protect themselves from zero-click ad attacks other than blocking ads as thoroughly as possible on all websites and platforms—a fact that intelligence agencies like the NSA and CIA seem to know all too well.
“The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario,” says Wolfie Christl, a senior Citizen Lab researcher.
During 2024 and 2025, Citizen Lab concluded that 45 devices belonging to the news outlet Al Jazeera were targeted with zero-click attacks delivered by ads. The researchers say that the targeted ads were issued by the Israeli-founded marketing firm Discover-Tech and distributed spyware attributed to the Israeli developer Candiru. Infected devices had contact with domains linked to Discover-Tech and then connected to infrastructure associated with Candiru, according to Citizen Lab’s analysis. (Al Jazeera, which participated in the investigation and shared device logs with Citizen Lab researchers, did not respond to a request for comment.)
“The ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem, and is perfectly suited to the mercenary spyware industry,” Marczak says. “Until this architecture changes, or ad companies get serious about customer vetting, we’re going to keep seeing this kind of abuse.”
Emails and messages sent to Discover-Tech and its CEO by WIRED did not receive a response before publication. Integrity Partners, which is believed to own Candiru’s assets, following sanctions by the US government in 2021, also did not respond to requests for comment.
Google, which operates one of the world’s largest advertising businesses, terminated Discover-Tech’s registration after collaborating with Citizen Lab and researchers from the cybersecurity firm Confiant and confirming a spyware link. “Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies,” a Google spokesperson says. “We also set up Safe Browsing warnings to help protect people if they navigate to websites linked to this group.”