Online ads can apparently do a lot more than track you. Citizen Lab has uncovered a technique called “AdFection” that uses targeted advertising to deliver zero-click spyware. The attack works without the victim clicking an ad. A malicious ad can be shown to a specifically targeted device, exploit a vulnerability, and potentially install spyware automatically. Citizen Lab traced the operation to Discover-Tech, an Israeli ad-tech company whose Controlium platform was used to profile and identify targets before delivering the spyware. Researchers found evidence that at least 45 devices at Al Jazeera were infected with Candiru spyware between 2024 and 2025. Discover-Tech’s advertising reached more than 120,000 websites and around 75,000 apps, potentially exposing hundreds of millions of users to the tracking infrastructure. Google and other advertising companies have since cut ties with Discover-Tech following the findings. citizenlab.ca/research/how-d…