Citizen Lab documents spyware delivery through targeted online ads

Citizen Lab researchers have identified what was described as the first publicly documented case of mercenary spyware being delivered through targeted online advertising, according to a post shared by Bitcoin News on X. In the case, malicious code could begin an infection once an ad loaded, without the user needing to click the ad or download anything. The operation was dubbed "AdFection." Researchers said at least 45 Al Jazeera devices were targeted between 2024 and 2025. The activity was linked to Israeli ad company Discover-Tech and spyware vendor Candiru. After reviewing roughly 4 billion ad bidding records, the researchers found that Discover-Tech ads had appeared across nearly 200,000 websites and apps worldwide, though ad exposure did not necessarily lead to infection in every case. The post also said Discover-Tech had previously operated through major ad networks, including Google, and was removed after the investigation.