The Ad-Tech Pipeline is the New Malware Vector
AI-generated image · US National Wire
For years, we were told to avoid the suspicious link. Now, the very architecture of digital advertising is being weaponized for zero-click state-sponsored spyware.
Q: What is "AdFection," and why is it a paradigm shift in cybersecurity?
A: As Wired first reported, "AdFection" is a campaign uncovered by researchers at The Citizen Lab at the University of Toronto. It represents a "nightmare scenario" because it allows mercenary spyware to silently infect devices as users simply browse the internet or use apps. Unlike traditional phishing, these are zero-click attacks, meaning they require no interaction or missteps from the target to install malware. As Bill Marczak, a senior researcher at Citizen Lab, explains to Wired, a victim might not see anything unusual—or even see the ad at all—while being hacked.
Q: Who were the primary actors involved in this specific campaign?
A: Wired reports that the targeted ads were issued by Discover-Tech, an Israeli-founded marketing firm. The spyware distributed through these ads is attributed to the Israeli developer Candiru. According to Wired, assets belonging to Candiru are believed to be owned by Integrity Partners, a firm that faced U.S. government sanctions in 2021.
Q: Who were the targets, and what was the scale of the attack?
A: Researchers from The Citizen Lab found that between 2024 and 2025, 45 devices used by the news outlet Al Jazeera were targeted by these zero-click ad attacks. On a broader scale, researchers estimate that millions of devices were directed to servers owned by Candiru for profiling purposes, as reported by Wired.
Q: How does the ad-tech infrastructure facilitate these attacks?
A: The process relies on real-time bidding, an automated auction where advertisers bid to show specific ads to users. This system allows for the collection of massive amounts of data regarding a user's location, device, and browsing history. Citizen Lab researchers told Wired that Discover-Tech operates an advertising platform called Controlium, which enables users to fingerprint, de-anonymize, and automatically infect devices once an ad is displayed.
Q: How has the industry responded to these findings?
A: A number of prominent organizations took steps to intervene after working with researchers from Confiant and The Citizen Lab. Wired reports that Google terminated Discover-Tech's registration for violating policies and implemented Safe Browsing warnings. Beeswax, a company owned by Comcast, also removed Discover-Tech from its platform. Additionally, IAB Europe (the European branch of the Interactive Advertising Bureau) suspended Discover-Tech from its Global Vendor List (GVL) following a policy audit.
Q: Is there any way for a user to protect themselves from zero-click ad attacks?
A: In a statement cited by Wired, Bill Marczak notes that there is very little users can do to protect themselves other than blocking ads as thoroughly as possible across all platforms and websites. This vulnerability is so acute that Marczak suggests intelligence agencies, including the CIA and NSA, are likely aware of the risk.