On October 15, Citizen Lab, a research institution at the University of Toronto, Canada, published its findings on "AdFection," an attack that infects devices with spyware through the display of targeted advertisements. This "zero-click" attack, which does not require users to click on ads, was confirmed to have infected devices belonging to the international news organization Al Jazeera.
According to the report, Israel-based Discover-Tech used an ad distribution network to select targets based on device identifiers and other information. Since advertisements can include not only images and videos but also programs, displaying an ad can trigger the loading of malicious code onto a target device, exploiting vulnerabilities and leading to infection. This means an attack can succeed even if the user does not click on any suspicious links.
Citizen Lab analyzed that Al Jazeera's devices were infected with Candiru spyware via Discover-Tech's advertisements between 2024 and 2025. A review of approximately 4 billion ad bid records revealed that Discover-Tech's ads were delivered to about 200,000 websites and apps over a four-month period.
Following notification of the findings, Google, advertising industry body IAB Europe, and others took measures to disconnect Discover-Tech from their ad distribution mechanisms. Citizen Lab also suggested blocking targeted advertisements at the organizational network level as a countermeasure.
In response to the report, Brave, a browser provider with built-in ad-blocking features, shared its perspective on its official X account on October 17. Brave explained that it blocks ads and trackers on websites by default, eliminating the need for users to change settings or add extensions.
However, Brave clarified that its blocking capabilities do not universally prevent ads within other applications, nor has it demonstrated complete protection against AdFection. Brave urged users at high risk of surveillance, such as journalists and activists, to take additional precautions.
Made with AI
