AdFection: How online ads became a vector for government spyware

The digital advertising industry faces a new dark chapter. Researchers at the University of Toronto’s renowned Citizen Lab have shown in a wide-ranging investigation that the infrastructure for personalized online advertising has been systematically exploited to carry out attacks using sophisticated spyware. The method, documented under the name AdFection, breaks with familiar patterns of cyberattacks: Victims don’t have to click links or open attachments to infect their devices (“Zero Click”). Simply loading a manipulated ad in an app or on a website is enough to cause devastating damage in the background.

According to the report , an Israeli company called Discover-Tech served as a key link between the advertising industry and providers of government spyware. The investigation paints a detailed picture of the technical ties. For years, Discover-Tech reportedly operated as an inconspicuous participant in the complex system of programmatic online advertising . The company was officially listed as an advertising partner by industry groups such as IAB Europe and tech giants such as Google, and served ads to hundreds of thousands of websites and apps in the spring. They included popular apps such as Germany’s Wetter Online, Duolingo and Viber, as well as various dating platforms.

The research team stresses that not every ad was automatically harmful. Rather, Discover-Tech initially used the extensive tracking ecosystem more broadly to build detailed profiles of millions of potential victims and target their devices with ad banners.

At the heart of the technical infrastructure, according to the analysis, was Controlium, a platform operated by Discover-Tech. It served as a central control hub for mercenary spyware companies such as Candiru, Bindecy and Intelos. When a user saw an apparently harmless, targeted ad placed by Discover-Tech, the device’s advertising ID and IP address were sent to the company’s servers.

When the system was supposed to hack a target’s devices, it sent malicious JavaScript code to them. The browser or app then ran the code in the background, exploiting vulnerabilities and infecting the target device without the person affected having to click anything. The attackers' clever move was that the ads themselves contained no exploit code. This allowed them to successfully conceal their malicious purpose from the platforms that served the ads and their automated security measures.

At the center of the attacks was the notorious spyware from Israeli company Candiru , which has repeatedly made headlines for selling surveillance tools to authoritarian governments and has been placed under U.S. export restrictions . The researchers were able to secure technical evidence of these attacks for the first time.

According to Citizen Lab, the Qatari news network Al Jazeera was hit particularly hard. The media company’s internal logs showed that at least 45 devices — mostly Windows computers — were infected with Candiru spyware through manipulated ads between 2024 and 2025. Saudi Arabia’s Ministry of Foreign Affairs also apparently came under attack. The experts also analyzed data indicating that manipulated ads had been displayed on devices linked to international organizations such as NATO, the U.N. and the EU. They also found evidence at global tech companies and chipmakers.

The scale of this attack vector has drawn the attention of national security agencies. Germany’s Federal Office for the Protection of the Constitution considers the new tactic a significant threat to Germany, according to Bayerischer Rundfunk . Counterintelligence circles consider the technique highly devious because it gives state-directed actors entirely new ways to attack sensitive targets. They don’t have to rely on victims' cooperation or carelessness. European Parliament member Daniel Freund, who had already been targeted by Candiru , told Netzpolitik.org he was deeply concerned . The Green Party politician calls it a new, extremely “insidious” form of surveillance.

The affected tech giants responded soon after the study became public. Google and IAB Europe said they had immediately removed Discover-Tech from their platforms and lists of advertising partners. They said they had found systemic policy violations.

Still, security experts remain unsettled. Wolfie Christl, a Citizen Lab researcher and co-author of the report, sums up the dilemma: The way online advertising works around the world today is an almost unmanageable security risk for governments, the private sector and civil society as a whole. Unless the advertising industry’s enormous, opaque data flows are fundamentally reformed, this digital ecosystem will remain vulnerable to such covert, mass-scale espionage attacks.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.