Citizen Lab just exposed AdFection, the first confirmed zero-click mercenary spyware delivered through targeted ads. Here's what you need to know. The report was published today, Oct 15, 2026, and WIRED, Reuters and the FT all covered it. Citizen Lab calls it the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. It names the technique AdFection. A normal-looking ad loads. If you're a target, you're infected. No click needed. Citizen Lab's John Scott-Railton says to protect yourself, block ads. The company behind it is an Israeli digital ad firm called Discover-Tech. Researchers say it used a huge ad network to track internet users and route chosen targets to spyware servers. The spyware was Candiru's, a vendor the US government has blacklisted. Discover-Tech also gave other Israeli surveillance firms access to ad platforms. Reuters and The Cradle report it used Google and Comcast ad networks. Citizen Lab says it infected dozens of devices. The targets included journalists. Researchers say 45 Al Jazeera computers were infected through ads in 2024 and 2025. Citizen Lab also saw ad impressions inside the networks of the European Parliament, the European Commission and the Council's General Secretariat, plus NATO and the UN. EU lawmaker Hannah Neumann is calling for an urgent investigation across EU institutions. Other researchers back this up. Amnesty's Security Lab says it independently tracked Discover-Tech and that Citizen Lab's findings match its own. Candiru's ad infection ability was first reported by Haaretz in 2023, which also described Insanet's Sherlock product as an optional zero-click method. Corporate records show surveillance vendor Intelos shared owners with Discover-Tech. Google has banned the firm from its ad platforms. Researchers say regulators and companies like Google and Microsoft need to act. One said today's online advertising is a systemic security threat. Key numbers: - 120,000+ websites and 75,000+ apps carried Discover-Tech's malicious ads (Citizen Lab) - Hundreds of millions of people likely reached (Confiant) - 45 Al Jazeera computers infected in 2024 and 2025 - Zero clicks needed from the victim The first confirmed case of spyware delivered through ads means any ad network can become a delivery route for state-grade surveillance.