New ‘zero-click’ spyware hacked phones using targeted ads

Dubbed "AdFection," researchers documented a campaign in which an Israeli-advertising firm, linked to spyware servers, infected numerous devices with invasive malware via targeted ads. This marks the first publicly available evidence of sophisticated spyware infecting devices through digital ads. Zero-click hacks, which automatically install malware without user interaction, are a significant threat to victims.

Evidence of this zero-click spyware campaign reveals the convergence of two major threats, emphasizing the urgency of addressing the risk. "AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet," explains Bill Marczak, a senior researcher at Citizen Lab.

Victims may not even notice any ad or intrusion. There is limited protection against such attacks, other than blocking ads on all websites and platforms. During 2024 and 2025, Citizen Lab found that 45 devices belonging to Al Jazeera were targeted by zero-click attacks delivered by ads. The targeted ads were issued by Discover-Tech, an Israeli marketing firm, and distributed spyware developed by the Israeli developer Candiru.

Infected devices connected to domains associated with Discover-Tech and Candiru. WIRED's requests for comment from Discover-Tech and its CEO were not answered prior to publication. Candiru's assets are owned by Integrity Partners, which did not respond to WIRED's inquiries. Google terminated Discover-Tech's ad platform following a joint investigation with Citizen Lab and Confiant, and the European branch of the Interactive Advertising Bureau (IAB) suspended Discover-Tech from its vendor list.

Beeswax, an online advertising company owned by Comcast, also removed Discover-Tech from its platform after confirming malicious activity. Discovered ads, often a result of real-time bidding, collect vast amounts of user data and have raised privacy concerns. Discover-Tech's advertising platform, Controlium, allegedly allows de-anonymization, fingerprinting, and automatic device infection once an ad appears.

The researchers estimate that millions of devices were directed to Candiru's servers, where profiling could occur. The ads linked to Discover-Tech appeared in over 70,000 mobile apps and 120,000 websites between March and June 2025. Government and national-security-linked networks, including NATO and UN networks, were among those showing Discover-Tech ads.