Security researchers have uncovered a novel zero-click spyware campaign, revealing that simply loading an online advertisement can infect a device without any user interaction like clicking or downloading. A deep investigation by Citizen Lab has singled out a technique dubbed “AdFection,” which was used to target journalists at an international media outlet with spyware tied to the Israeli vendor known as Candiru (now operating under the name Integrity Labs). These infections are confirmed to have occurred between 2024 and 2025, affecting dozens of devices.
How AdFection Works
The attack begins when a Discover-Tech ad is displayed. Behind the visuals in the ad lies hidden code that reaches out to a Discover-Tech server to determine whether the viewer matches certain criteria—based on browser cookies, mobile advertising IDs, IP address, and other identifiers. If a match occurs, JavaScript served by the ad triggers further code that initiates the spyware installation. No click or download is required.
These ads spanned nearly 200,000 websites and apps across many countries, and logs show that millions of devices were funneled toward Candiru-related servers for evaluations or tracking, though only a small subset were chosen for full infection. In one documented case, about 45 devices belonging to international media staff were compromised.
Spyware Behavior and Infrastructure
Once the infection begins, the spyware payload uses techniques like DLL hijacking on Windows, along with a repeating 48-byte XOR encryption for string obfuscation. Researchers recovered a binary linked to earlier Candiru toolchains, identifying matching behavioral traits and infrastructure. The sample’s SHA-256 hash has been published.
Discover-Tech’s ad platform, Controlium, played a key role as the supply chain link between ad networks and commercial spyware operations. Further complicating matters, other actors—including DARK CARTOGRAPHER—leveraged the same infrastructure to connect advertising IDs with phone numbers through carrier exploits.
Marketplace Reactions and Defenses
Major ad platforms and regulatory bodies have taken swift action. Discover-Tech has been removed from several advertising services, including Google’s platforms. Vendor certification groups have suspended it, and others have blocked domains or paused related accounts.
For individuals and organizations, defensive measures go beyond avoiding suspicious links. Blocking known Discover-Tech and Candiru servers, monitoring for odd ad-related traffic, isolating browsers, disabling personalized ads, and controlling third-party scripts can all help reduce exposure.
This campaign shows that traditional advice—don’t click strange ads—is no longer sufficient. When merely viewing an ad can initiate a spyware toolchain, the boundaries between ad tech and cyber threat actors blur. The discovery of AdFection indicates a dangerous shift: advertising platforms are not just marketing channels but potentially covert vectors for digital intrusion.
