Security training usually says: don’t click strange links. New research from the University of Toronto’s Citizen Lab describes an attack where there’s nothing to click at all. Researchers call it “AdFection”: targeted ads that quietly infect a device just by being loaded, sometimes without the person even seeing an ad.
What researchers found
According to Citizen Lab and WIRED’s reporting:
- In 2024 and 2025, 45 devices belonging to Al Jazeera were targeted through ads. Citizen Lab links the ads to the Israeli-founded marketing firm Discover-Tech and the spyware to Candiru, a company the US government placed on its Entity List in 2021.
- Discover-Tech’s ads, carrying the attacker’s script tags, ran in more than 70,000 mobile apps and more than 120,000 websites between March and June, by researchers’ count from exposed bidding records. Not every ad was weaponized.
- Impressions turned up on sensitive networks, including NATO, the UN and government agencies in several countries.
- Google says it has blocked Discover-Tech from its ad platforms and added Safe Browsing warnings. IAB Europe has suspended the firm from its vendor list.
Citizen Lab’s Bill Marczak notes the main defense available to ordinary people is blocking ads as thoroughly as possible.
Field notes: protecting your people
- Know who’s most at risk. Mercenary spyware is aimed at specific people: executives, journalists, legal and finance staff, people who travel to sensitive regions. Start there.
- Block ads at the network level. A DNS filtering service on company networks and managed devices blocks ad and tracking domains for every app, not just the browser.
- Add browser-level blocking. Deploy an approved content blocker through your device management tool so it’s on by default and can’t be quietly removed.
- Cut down on ad-supported apps. On work phones for high-risk staff, prefer paid or ad-free versions of apps, and remove free games and utilities that serve ads.
- Use your phone’s high-security modes. Both major mobile platforms offer hardened modes for people at elevated risk. Turn them on for the people on your list.
- Keep devices updated. Spyware chains depend on unpatched flaws. Fast OS updates shrink the window.
- Log network traffic where you can. Citizen Lab says Al Jazeera’s network logs were key to spotting the attack. Devices on home Wi-Fi or mobile data rarely have that visibility.
The takeaway
Ads are now a delivery route for some of the most invasive malware there is. For most staff, a blocker is a nice-to-have; for your highest-risk people, treat it as a security control.
Based on reporting by WIRED and Citizen Lab.
