Skip to content

Image: media.wired.com · rights & removal

‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads

Reporting by Wired - SecurityRead the original at wired.com

Objectivity score: 59 out of 100.
Difficulty 77 out of 100 (Expert)— Read Analysis

Executive Summary

Sophisticated spyware is now documented to infiltrate devices through the normal browsing experience, a newly identified vector dubbed "AdFection." Researchers from The Citizen Lab found evidence of an attack campaign where malware was silently delivered when targets viewed specific digital advertisements. This merging of zero-click hacking—which requires no user interaction—with the vast infrastructure of online advertising represents a significant escalation in cyber threats. A case targeting 45 devices belonging to Al Jazeera showed that ads issued by the Israeli firm Discover-Tech connected to spyware attributed to the developer Candiru. Experts emphasize this presents a nightmare scenario because users have minimal actionable defense against such stealth attacks, beyond rigorous ad blocking across all platforms. Industry bodies and major advertising platforms, including Google and IAB Europe, have responded by taking actions against Discover-Tech following these findings.

Facts Only

Researchers from The Citizen Lab at the University of Toronto revealed an AdFection campaign.
An Israeli-registered advertising firm allegedly connected to servers linked to a spyware company in this documented case.
The campaign infected dozens of devices using invasive malware delivered via digital ads.
Zero-click hacks automatically install malware without target interaction, often exploiting messaging apps or ad ecosystems.
Citizen Lab concluded 45 Al Jazeera devices were targeted during 2024 and 2025 with zero-click attacks delivered by ads.
The targeted ads were issued by Discover-Tech and distributed spyware attributed to Candiru.
Infected devices connected to domains linked to Discover-Tech and subsequently to infrastructure associated with Candiru.
Google terminated Discover-Tech’s registration after confirming a spyware link through joint investigation.
IAB Europe suspended Discover-Tech from its global vendor list, the GVL, following an audit of its policies.
Citizen Lab estimated that ads linked to the firm were shown in over 70,000 mobile apps and 120,000 websites between March and June this year.

Full Take

The emergence of AdFection challenges a long-held public understanding of

From the original · Wired - Security

On Thursday, researchers from The Citizen Lab at the University of Toronto revealed a worst-case scenario found in the wild: spyware silently infecting targets as they browse past ads in their daily digital lives.
Read the full story at wired.com

Sentinel — Human

Confidence

This article reads like detailed investigative reporting, presenting specific technical findings while thoughtfully building bridges between a narrow security incident and the broader vulnerability of the modern ad ecosystem. The probabilistic nature of reporting on such complex threats is evident.

Signals Detected
low severity: Moderate variance in sentence structure; professional but narrative flow.
low severity: Effective movement from a specific finding (AdFection) to broader systemic implications.
low severity: Standard journalistic attribution patterns, citing multiple parties in sequence.
low severity: Specific details (70k+ apps/120k+ websites, specific dates) are provided, grounding the claims.
Human Indicators
Inclusion of non-responses from entities (Al Jazeera, Integrity Partners), which introduces narrative tension typical of investigative reporting.
Use of direct quotes to frame both immediate threat severity and future systemic issues.
The structure moves beyond just stating the 'what' to contextualizing 'why it matters' within established digital privacy/ad-tech frameworks.
‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads | Huntaegis