AdFection zero-click spyware delivered through targeted online advertising

For years, internet safety sounded reassuringly simple.

Don't click suspicious links.

Don't download strange files.

Don't install unknown apps.

Don't click suspicious ads.

Good advice.

Keep following it.

But researchers have now documented something that makes one piece of that old advice feel disturbingly incomplete.

On October 15, 2026, researchers at the University of Toronto's Citizen Lab published an investigation describing what they say is the first public technical confirmation of zero-click mercenary spyware delivered through targeted online advertising.

They gave the technique a new name:

And yes, the capital F makes the word look slightly strange.

The technology behind it is considerably stranger.

What Is AdFection?

AdFection is a newly coined term used by Citizen Lab for a technique in which targeted online advertising is used to deliver zero-click mercenary spyware to selected devices.

Zero-click is the disturbing part.

A traditional malicious-ad scenario may depend on a person clicking a link, visiting another page, downloading something or installing software.

In the AdFection attacks documented by Citizen Lab, the researchers found that spyware could be delivered when a specially targeted advertisement was rendered.

The user did not necessarily have to click it.

In some cases, the advertisement might even render in the background.

🧠 AIWhyLive Explains: How Can an Advertisement Do That?

Most people see an advertisement as a rectangle on a screen.

Behind that rectangle can be an enormous automated advertising system.

When you open a website or app, advertisers may compete in a digital auction for the opportunity to show an advertisement to that particular device.

This can happen in a fraction of a second.

The advertising ecosystem can use information and identifiers associated with users and devices to decide which advertisements should be shown.

Advertising technology was designed to answer a commercially valuable question:

AdFection demonstrates the danger of changing that question to:

That is the bigger story.

From Customer Targeting to Cyber Targeting

Targeted advertising exists because advertisers don't necessarily want to show every advertisement to everybody.

They want relevance.

The right audience.

The right device.

The right location.

The right interests.

The right moment.

Usually the goal is simple:

sell something.

But technology capable of finding the right customer can potentially become valuable to someone trying to find the right target.

How the AdFection Attack Worked

Citizen Lab's investigation describes a company called Discover-Tech operating infrastructure connecting online advertising with mercenary spyware partners.

At a simplified level, the process looked something like this:

The important words are:

selected target.

This wasn't simply a case of spraying the same malicious payload at every person who happened to see an advertisement.

The targeting capability is precisely what makes the technique significant.

You Didn't Click Anything. How Could You Still Be Attacked?

Websites and apps don't contain only the words and pictures you see.

They can also execute code.

Advertising systems can load content and code from multiple parties.

Citizen Lab found that Discover-Tech advertisements contained code capable of connecting back to the company's infrastructure and supplying advertising identifiers.

Its servers could then decide whether a particular device was eligible to receive additional JavaScript.

If it wasn't the desired target, nothing useful to the attack needed to happen.

If it was?

The infrastructure could respond differently.

This selectivity also helps explain why detecting such abuse can be difficult.

Who Was Actually Infected?

Citizen Lab says it confirmed that devices at the international news organization Al Jazeera were infected using Candiru mercenary spyware delivered through targeted advertisements.

The researchers describe this as the first public technical confirmation of this kind of zero-click mercenary-spyware delivery through targeted ads.

This distinction matters.

The investigation also found Discover-Tech advertising activity across a much larger advertising ecosystem.

Citizen Lab analyzed roughly four billion bidding records covering a four-month period and found the company's ads appearing across almost 200,000 unique websites and Android/iOS apps in dozens of countries.

It also found millions of devices being directed to contact Candiru infrastructure, which the researchers assess was likely used for large-scale tracking and reconnaissance.

🐘 The Elephant in the Room: Was the Website Even the Enemy?

This may be the most unsettling part for ordinary internet users.

You could be visiting a legitimate website.

The publisher could be legitimate.

The app could be legitimate.

The content could be legitimate.

Yet advertising can involve multiple companies and automated systems operating behind the page you actually see.

Our old mental model of internet danger often looks like this:

AdFection demonstrates a different possibility:

That doesn't make legitimate publishers responsible for every hidden actor somewhere in the advertising chain.

It demonstrates why the chain itself deserves scrutiny.

What Could AdFection Spyware Potentially Do?

The word spyware sometimes sounds less serious than it is.

Advanced mercenary spyware is designed for surveillance.

Depending on the spyware, device, exploit and privileges obtained, a successful compromise can potentially expose highly sensitive information or activity.

Possible consequences of sophisticated spyware can include access to private communications, stored information, account or device data, location-related information and other sensitive material available from a compromised device.

The exact capabilities depend on the spyware and the successful level of access.

The bigger issue is simple:

For a journalist, government official, activist, executive, researcher or anyone handling sensitive information, compromising the device can potentially expose information involving many other people as well.

Who Should Be Most Concerned About AdFection?

Everyone benefits from good digital security, but the documented AdFection technique is especially relevant to people who may be targets of sophisticated surveillance because of who they are, what they know or what they do.

That can include journalists, researchers, activists, government personnel, political figures, executives, security professionals and people handling highly sensitive information.

This does not mean everybody in those groups is being targeted.

It means their threat model can be different from that of an ordinary internet user.

🍗 Lechon Manok: Internet Safety Has Received an Update

Internet Safety, 2005:

"Don't click suspicious ads."

Internet Safety, 2015:

"Don't install suspicious apps."

Internet Safety, 2020:

"Don't open suspicious links."

Internet Safety, 2026:

"What did you click?"

"Nothing."

"Excellent."

"So I'm safe?"

"Well..."

😂

Does This Mean You Should Panic About Every Online Ad?

No.

That would be the wrong lesson.

The Citizen Lab investigation concerns sophisticated targeted surveillance and mercenary spyware.

It does not demonstrate that every online advertisement can infect every device.

It does not mean every advertising company is secretly distributing spyware.

It does not mean every publisher showing advertisements is participating in surveillance.

And it does not mean seeing an advertisement proves you were attacked.

The correct lesson is more precise:

That's serious enough without exaggerating it.

What Can Ordinary Users Do?

🧠 AIWhyLive Explains: Why "Don't Click" Is Still Good Advice

A zero-click attack does not make clicks harmless.

It means clicking is no longer the only possible route.

Think of home security.

Locking the front door remains intelligent even after discovering that sophisticated burglars may have other ways inside.

You don't respond by leaving the front door open.

You improve the rest of the house.

The same principle applies here.

The Advertising Industry Has Already Responded

The Citizen Lab investigation was disclosed to companies and advertising-industry organizations before publication.

Google terminated Discover-Tech's access to its ad exchange platforms and deployed Safe Browsing protections involving known actor-controlled domains.

Beeswax removed Discover-Tech from its ad-buying platform.

Vungle, now part of Liftoff, paused Discover-Tech's access while reviewing the issue.

Eskimi blocked associated accounts and domains.

IAB Europe also suspended Discover-Tech from its Global Vendor List following a compliance audit.

Those responses matter.

But they also lead to an uncomfortable question.

🐘 Another Elephant: What Does "Trusted" Mean in a Giant Advertising Chain?

An ordinary user doesn't see most of the advertising ecosystem.

You see the rectangle.

Behind it may be exchanges, bidders, demand-side platforms, supply-side platforms, identifiers, tracking systems, scripts and companies you have never heard of.

Some interactions happen in milliseconds.

That creates an enormous trust problem.

Not necessarily because everybody involved is malicious.

Quite the opposite.

Complex systems can become dangerous when one malicious or compromised participant can exploit relationships built for legitimate purposes.

The Real Privacy Story Behind AdFection

AdFection is a cybersecurity story.

But underneath it is also a privacy story.

Modern targeted advertising became valuable because computers became increasingly good at distinguishing one audience, user or device from another.

Advertising wants to know:

Who might buy?

Who might click?

Who might be interested?

Who should receive this advertisement?

Surveillance can ask a darker version of the same question:

Who is the target?

That's where advertising technology and surveillance can become uncomfortable neighbors.

👦 ELI12: What Is AdFection?

Imagine a school gives advertisers permission to put flyers into students' lockers.

The system is very smart.

It knows which locker should get a football flyer.

Which should get a gaming flyer.

Which should get a book flyer.

Then somebody realizes:

"Wait. If this system can deliver a specific flyer to one specific locker, could I use it to deliver something harmful to one specific locker?"

That's the scary idea behind AdFection.

The problem isn't the ordinary flyer.

The problem is that the delivery system can potentially be abused to target someone very precisely.

AdFection Is a New Word. The Problem Behind It Is Bigger.

The word AdFection may be new.

Citizen Lab introduced it in October 2026 to describe the zero-click spyware-delivery technique documented in its investigation.

Whether the term eventually becomes common cybersecurity vocabulary remains to be seen.

But the problem it describes deserves attention now.

Advertising systems operate at enormous scale.

Targeting happens automatically.

Auctions happen almost invisibly.

Code can move between companies and devices.

Most users never see any of this.

And the more invisible a system becomes...

the easier it is to forget how much trust we place in it.

Frequently Asked Questions About AdFection

What is AdFection?

AdFection is a term introduced by Citizen Lab in October 2026 for a technique in which targeted online advertisements are used to deliver zero-click mercenary spyware to selected devices.

Who coined the term AdFection?

Citizen Lab used the term in its October 15, 2026 report, Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware.

Do you have to click an AdFection ad?

According to Citizen Lab's documented cases, no click was required. The researchers describe spyware delivery triggered through specially targeted advertising when an ad was rendered, including situations where an ad could render in the background.

Can an online ad infect a phone without being clicked?

Citizen Lab says its investigation provides the first public technical confirmation of zero-click mercenary spyware being delivered through targeted online advertising. This does not mean ordinary advertisements routinely infect phones or that every device is vulnerable to every ad.

Does AdFection affect every advertisement?

No. AdFection describes a targeted spyware technique documented in a specific investigation. It should not be interpreted to mean that every online advertisement is malicious.

Does seeing a Discover-Tech ad mean a device was infected?

No. The appearance of an advertisement does not by itself establish that a device was compromised. Citizen Lab's broader advertising data and its confirmed infection evidence represent different things and should not be confused.

What spyware was connected to the documented AdFection attacks?

Citizen Lab connected the confirmed attacks to mercenary spyware from Candiru, which the researchers note has rebranded as Integrity Labs.

Who is most at risk from AdFection?

The documented technique is particularly concerning for people likely to face sophisticated targeted surveillance, such as journalists and others handling sensitive information. Good device security remains useful for everyone.

Can blocking ads stop AdFection?

Reducing advertising exposure and tracking may reduce some attack surface, particularly for high-risk users, but no single measure should be treated as guaranteed protection against sophisticated mercenary spyware. Updates, privacy controls, enhanced device-security modes and professional security assistance may also be appropriate depending on a person's risk.

Should I stop using websites that show ads?

Not based on this research alone. An advertisement appearing on a website does not mean the website is malicious or knowingly involved in spyware distribution. The investigation highlights weaknesses and abuse within the wider advertising supply chain.

🎤 Drop Mic: What Did You Click?

For years, the internet taught us to fear what we clicked.

Don't click the strange link.

Don't download the strange file.

Don't install the strange app.

Don't tap the suspicious advertisement.

Good advice.

Keep following it.

But AdFection introduces a more uncomfortable possibility.

The modern internet doesn't merely wait for you to click.

Behind the screen, enormous automated systems are constantly deciding what should be shown to which device.

Advertising built much of that machinery to find customers.

Citizen Lab's investigation shows how such machinery can be abused to help find targets.

The advertisement itself may look ordinary.

The website may look ordinary.

The app may look ordinary.

The person holding the phone may do nothing obviously wrong.

And that may be the most important lesson.

Welcome to AdFection.

A new word for a cybersecurity problem we should probably learn before we ever have a reason to experience it.