AdFection Spyware: Zero-Click Ads Infect Al Jazeera Phones Without User Interaction
Citizen Lab researchers found that mercenary spyware is silently installing on devices through digital advertisements, requiring no user interaction to compromise phones.
Key points
- Citizen Lab documented the AdFection campaign, where zero-click spyware was distributed via targeted online ads during 2024 and 2025.
- The attack infected dozens of devices belonging to Al Jazeera journalists, using infrastructure linked to an Israeli marketing firm and spyware developer.
- Researchers warn that victims may not see any advertisements or notice unusual activity, making detection extremely difficult for targeted individuals.
Journalists and digital workers face a new threat vector where sophisticated spyware installs automatically through online advertisements. Researchers at The Citizen Lab at the University of Toronto released technical evidence on Thursday showing that mercenary spyware is being distributed via targeted ads. This method allows attackers to compromise devices without any interaction from the victim, marking a significant escalation in digital surveillance capabilities.
The campaign, dubbed AdFection, involved an Israeli-registered advertising firm connected to servers linked to a spyware company. Citizen Lab believes this is the first detailed public evidence of such sophisticated spyware infecting devices via digital ads. The researchers documented that dozens of devices were infected during this operation. The attack merges the zero-click exploit model with the sprawling online ad ecosystem, creating a scenario where browsing the internet or using apps can lead to silent compromise.
How the attack works
Zero-click attacks are considered a holy grail for attackers because they bypass user error. Previously, these rare exploits often targeted vulnerabilities in mobile messaging and communication applications. However, this campaign demonstrates that attackers are also exploiting the infrastructure of online advertising to distribute malware. Bill Marczak, a senior researcher at Citizen Lab, noted that operators can automatically hack specific individuals as they use apps or browse the internet. Victims typically see nothing amiss and might not even notice an ad appearing on their screen.
Who is affected
During 2024 and 2025, Citizen Lab concluded that forty-five devices belonging to the news outlet Al Jazeera were targeted with these zero-click attacks. The targeted advertisements were issued by Discover-Tech, an Israeli-founded marketing firm. The spyware attributed to the attacks was developed by Candiru, an Israeli developer. The researchers stated that the risk of having a device infected simply by using a website or app that displays ads represents a nightmare scenario for privacy and security. Wolfie Christl, another senior researcher, emphasized the catastrophic nature of these zero-click hacks for victims.
Our take on the response
The difficulty in protecting against this threat is significant. Bill Marczak noted that there is little people can do to protect themselves from zero-click ad attacks other than blocking ads as thoroughly as possible on all websites and platforms. He pointed out that intelligence agencies like the NSA and CIA seem aware of this vulnerability. Because the infection happens silently and requires no user interaction, traditional security advice about avoiding suspicious links is less effective here. The merging of ad infrastructure and spyware distribution underscores the urgency of the risk.
For customers and users
Individuals targeted by state-level or mercenary spyware often have limited direct controls. However, users should check whether their devices show signs of unusual battery drain or data usage, which can indicate background processes. Teams usually recommend enabling strict ad-blocking measures on all browsers and applications to reduce exposure to malicious ad networks. It is also wise to monitor for unexpected system reboots or permission changes. Recognize that follow-up scams may attempt to exploit the confusion of a breach, so verify all communications through trusted channels.
What to do and how to stay safe: Citizen Lab
- Enable comprehensive ad-blocking tools on all web browsers and mobile devices to reduce exposure to malicious ad networks.
- Monitor device performance for unexplained battery drain or increased data consumption, which may indicate hidden background processes.
- Keep operating systems and applications updated to patch known vulnerabilities that could be exploited by similar attack vectors.
- Verify the authenticity of any urgent communications claiming to be from security providers or news organizations to avoid follow-up scams.
Step-by-step guide: How to Stop Ransomware: 3 Layers That Actually Work
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is the name given by Citizen Lab researchers to a campaign where zero-click spyware was distributed via targeted online advertisements to infect devices silently.
Which organization was targeted in this campaign?
The news outlet Al Jazeera was targeted, with forty-five of its devices infected by the spyware during 2024 and 2025.
Who developed the spyware used in the attacks?
The spyware is attributed to Candiru, an Israeli developer, and the ads were issued by the Israeli-founded marketing firm Discover-Tech.
