Security researchers at Citizen Lab have uncovered a sophisticated cyber espionage technique dubbed “AdFection,” which weaponises the global online advertising ecosystem to deliver zero-click spyware to targeted devices.

The investigation revealed that an Israeli digital advertising agency named DiscoverTech exploited programmatic ad auctions – the automated, split-second bidding markets used to buy and sell ad space across websites and mobile apps – to covertly track and infiltrate users.

Through its proprietary “Controlium” software platform, DiscoverTech allegedly enabled clients to mass-profile and de-anonymize internet users before deploying third-party mercenary spyware.

The attack mechanism bypasses traditional security warnings entirely. When a user visits a legitimate website or mobile app, their browser or application automatically connects to ad servers to load content and transmit device identification data.

The research identified at least 45 devices belonging to Qatari broadcaster Al Jazeera that were compromised between 2024 and 2025 using tools linked to the Israeli surveillance software company Candiru.

Once installed, the spyware can extract sensitive data, including passwords, messages, photos, and emails, while also enabling remote microphone activation.

While DiscoverTech presented itself as a standard advertising firm, investigators found no evidence of legitimate ad business. Analysis showed its ads appeared on over 120,000 websites and 70,000 mobile apps globally, reaching networks tied to government entities, European and US agencies, the United Nations, and NATO.

Google subsequently blocked DiscoverTech from its ad platforms. Security experts have called for urgent regulatory intervention to address the systemic vulnerabilities underpinning the digital advertising industry.

For latest tech stories go to TechDigest.tv