Zero-Click Spyware via Ads: What It Means for Your Phone

Zero-click spyware delivered through online ads? It sounds like a plot from a spy movie, but it’s a very real threat. Researchers have uncovered a sophisticated campaign, dubbed “AdFection,” where invasive malware infected devices without the victim doing a thing. No suspicious links to click, no dodgy attachments to open. Just the simple act of using an app or browsing a website with ads was enough. Let's break down what this means for your phone and your privacy.

Your Phone Can Be Hacked Just by Seeing an Ad

This isn't your average pop-up nuisance. It's a chilling new frontier. For years, we've been told to be wary of phishing emails or malicious links, and that advice served as our main defense against the constant tide of digital threats that wash over us every single day. But this new wave of attacks, identified by security researchers, bypasses all that. It's truly a "zero-click" scenario. The malware silently installs itself in the background.

How does it work? The campaign involved an Israeli-registered advertising firm, Discover-Tech, allegedly linked to servers that distribute spyware from another Israeli developer, Candiru. They took advantage of the sprawling, often murky online advertising business. You see an ad, or sometimes, you don't even see it. But in those milliseconds, a hidden script can activate, profiling your device and pushing malicious code.

Bill Marczak, a senior researcher, explains the severity. “AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet.”

Someone who gets hacked like this wouldn't see anything amiss. They might not even see any ad at all. And that's the thing, because if you're the person sitting there staring at your screen, you don't get a warning, you don't get a popup, and you can't tell that anything has gone wrong at all, according to Bill Marczak, Senior Researcher.

That's the nightmare scenario. Complete compromise. No warning signs at all. You could be reading an article, scrolling social media, or checking the weather, and your phone's defenses are breached, and you've got no idea it's happening, and there's nothing you can do about it. And they're already inside.

Who Is at Risk? Everyone Who Sees Ads

While this particular campaign targeted specific individuals, the underlying mechanism affects anyone who encounters digital advertising. Researchers found dozens of devices were infected. During 2024 and 2025, an astonishing 45 devices belonging to the news outlet Al Jazeera were hit with these zero-click attacks. The targeted ads came from Discover-Tech and delivered spyware attributed to Candiru. Al Jazeera even shared device logs to help with the investigation.

This isn't just about high-profile targets either. The ad-bidding records reviewed by researchers showed ads linked to Discover-Tech, containing attacker script tags, appeared in over 70,000 mobile apps and more than 120,000 websites between March and June of this year. Some apps displayed over a million of these ads. While not all were weaponized, the sheer scale is staggering. Millions of devices were directed to Candiru’s servers for potential profiling.

The reach of Discover-Tech’s ad impressions extended to sensitive networks globally:

• NATO and United Nations networks
• Lawmaking bodies in Europe
• Critical infrastructure providers in Australia
• Armed forces and government agencies in Norway and Sweden

This shows how deeply integrated and trusted the ad infrastructure is, often without the necessary oversight to prevent such abuse.

Why This Threat Is So Hard to Stop

The core issue lies in the nature of the online advertising ecosystem. Real-time bidding, the automated auction process that decides which ad you see in milliseconds, collects vast amounts of data about you: your device, location, and browsing history. This data-rich environment is ripe for exploitation.

Marczak stated that the ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem. It's perfectly suited to mercenary spyware. He added that until this architecture changes, or ad companies get serious about customer vetting, we're going to keep seeing this kind of abuse. And they don't seem to care.

For you, the user, protection is incredibly difficult. Wolfie Christl, another senior researcher, didn't mince words: “The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario.” Intelligence agencies apparently know this well. Personal devices lack the strong network monitoring that corporate or government networks have, which makes these attacks extremely stealthy and hard to detect.

What Actions Are Being Taken, and What Can You Do?

The good news? Major players are reacting. Google, a giant in the ad business, terminated Discover-Tech's registration from its ad platforms, and they collaborated with researchers and confirmed the spyware link. Google also added Safe Browsing warnings. But it's not over. For websites connected to this group, those warnings now appear, and while the company says it's a step forward, we've seen how slowly the wider industry moves when it's asked to act.

The Interactive Advertising Bureau's European branch suspended Discover-Tech. It's an industry body. So the company is off its global vendor list now. Beeswax, an online advertising company that also removed Discover-Tech from its platform, cited a zero-tolerance policy for malicious advertising, which is a stance they're clearly applying here since they don't want that kind of activity anywhere near their business. And that's the whole story.

But the real takeaway for you? Protection against this specific type of zero-click spyware through ads is limited. Researchers suggest that blocking ads as thoroughly as possible across all websites and platforms is one of the few practical steps. That means using strong ad blockers in your browsers and looking into ad blocking options inside apps, where they exist.

This situation points to a critical need for the ad industry to rethink its architecture and vetting processes from the ground up. Until then, your best defense is vigilance and proactive ad blocking.