A new cyberattack method has been identified that can infect smartphones and computers with spyware simply by viewing online ads. The "zero-click" attack operates without a user click or file download, prompting criticism that existing ad systems were exploited as channels for surveillance and hacking.

On Oct. 16, Japanese outlet Gigazine reported that Citizen Lab, a research group at the University of Toronto, said it had discovered spyware attacks using the system of Israeli ad tech firm Discover-Tech.

Researchers named the attack "AdFection". It is the first time technical evidence has been disclosed showing zero-click spyware was actually distributed through targeted advertising.

The attack used Discover-Tech's advertising platform Controlium. Attackers selected specific devices using IP addresses and ad identifiers and then delivered malicious ads.

When the ad was displayed, embedded code connected to an external server and fetched additional programs. The attack could proceed even if users did not click the ad. It was also harder to detect because the malicious code was not delivered to non-target devices.

At international media organisation Al Jazeera, at least 45 devices were designated as targets in 2024 to 2025. Infection with malicious software from Israeli spyware firm Candiru was confirmed on some devices.

The affected devices were found to have connected via Discover-Tech servers to Candiru's validation servers and attackers' command-and-control servers. The government or organisation that ordered the attack was not identified.

After Citizen Lab analysed about 4 billion ad bidding records, related ads were exposed on about 200,000 websites and mobile apps worldwide from March to June 2026. With millions of devices connecting to Candiru servers, the possibility was raised that it may also have been used for large-scale surveillance.

Google removed Discover-Tech from its list of advertising vendors earlier this month and blocked access to its ad exchange network. Other ad companies took similar steps.

The researchers said it would be difficult to prevent such attacks through the ad industry's self-regulation alone, and called for stronger security for ad systems and investigations by regulators.