Viewing an online advertisement can now easily infect a device with powerful spyware, without the user clicking, downloading a file, or seeing any warning This article explores advertising spyware. . Researchers at Citizen Lab have documented what they call the first public technical proof of zero-click mercenary spyware delivered through targeted ads.

The method, named "AdFection," infected devices at international news network Al Jazeera with spyware linked to Israeli vendor Candiru, which now operates as Integrity Labs. 0-Click Spyware Infections Devices Discover-Tech, an Israeli company that presents itself as an advertising business, is linked to several commercial spyware groups through its Controlium platform. This technique leverages the sophisticated nature of modern ads, which often include code for tracking views, monitoring users, and loading content from other sources.

The company’s ads reached over 200,000 unique websites and apps across numerous countries. The Citizen Lab urged ad companies to enhance vendor checks, scan ad code, share threat data, and cease unknown third-party code from running without rigorous review. The confirmed Al Jazeera infections demonstrate that targeted advertising can be part of a spyware delivery chain, while the extensive reach of these ads underscores the severity of the issue beyond a single newsroom.

Enhanced advertising regulations, swift platform responses, and improved network surveillance are essential to safeguard against hidden paths to user devices through online ads.