{
  "id": 16634617,
  "title": "Lessons Learned From 'AdFection' and What To Do Next",
  "url": "https://urgent.news/2026/10/26/lessons-learned-from-adfection-and-what-to-do-next",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-26T17:28:02.000Z",
  "source": {
    "name": "EFF Deeplinks",
    "slug": "eff-deeplinks",
    "url": "https://www.eff.org/deeplinks/2026/10/lessons-learned-adfection"
  },
  "original_language": "en",
  "account": "Last week, Citizen Lab detailed a new malware campaign called \"AdFection\" that employed ad networks to infect journalist's devices without them clicking anything. This type of attack on journalists is alarming and concerning, especially as it exploits a technology we already object to: behavioral advertising. Although this specific attack has only targeted journalists so far, you can follow a few steps to mitigate the risk, regardless of who you are.\n\nSeveral factors combined to make this attack noteworthy. First, it used the surveillance ad-tech ecosystem to specifically target the malicious code. Second, the spyware it delivered was zero-click, meaning it required no user interaction to infect the device. Neither malvertising nor zero-click attacks are new on their own, but the combination of the two creates a highly targeted, dangerous attack that's difficult to defend against and even harder to detect.\n\nLet's examine how the infection occurred using the example of a Windows device supplied to researchers from Al Jazeera. The researchers found that when someone browsed the web or used an app on that machine, they were served an ad created by Discover-Tech, a company that appears to be a front for large-scale ad espionage abuse. The ad contained JavaScript code that, when executed, reached out to a Discover-Tech server called their \"NOAS server\" with detailed information about the machine, including its cookie-set advertising ID and IP address. This information was used to determine that it was an Al Jazeera machine, prompting the NOAS server to respond with a malicious zero-click spyware payload created by Discover-Tech's partner Candiru/Integrity Labs. The payload was then executed and infected the targeted machine.\n\nThis attack highlights how ad-tech companies' everyday practices, such as collecting tracking identifiers and data for targeted ads, can be repurposed by mercenary spyware companies to fine-tune who they infect and hide their activities. While the components of this attack chain are not novel, the exposure of this combined attack reveals a technique to hyper-target individuals and organizations for infection.\n\nTo protect yourself from the dangers presented by the ad-tracking industry, take some simple steps right now. Establish strong security fundamentals, use a browser extension to reduce tracking, consider network-wide ad blocking services, and disable or reset your AD ID on mobile phones. While these steps can help protect you, it's essential to push for fundamental fixes to the ad ecosystem and banning online behavioral ads altogether.",
  "summary": "Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly concerning, especially since it’s built on the backbone of a technology we already object to:…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}