Citizen Lab Shows How AdFection Spyware Infects Devices via Ads

Researchers at The Citizen Lab have published the first technical evidence showing how sophisticated mercenary spyware was distributed via online advertising channels. This campaign, identified as AdFection, utilized an Israeli advertising company to route targeted individuals to servers hosting the malicious code. According to Wired, the operation successfully infected dozens of devices using a zero-click method, meaning victims did not need to click any links or open attachments to become compromised.

How did the AdFection campaign operate?

The campaign relied on a commercial advertising infrastructure to deliver the payload. Instead of using traditional phishing emails or malicious downloads, the threat actors leveraged an Israeli ad company’s services. This entity routed the traffic of specific targets to servers controlled by the spyware operators. The delivery mechanism was entirely passive for the victim, classifying it as a zero-click attack. The user simply visited a site or viewed an ad, and the infection occurred in the background.

What evidence supports these findings?

The Citizen Lab provided detailed technical documentation to substantiate the claims. This report marks the first release of concrete proof linking this specific mercenary spyware to distribution via online ads. The researchers outlined the network paths and server interactions that confirmed the route from the advertising platform to the malware hosting infrastructure. This evidence connects the commercial ad entity directly to the deployment of the surveillance tool on the devices of the targeted individuals.

Who was affected by this operation?

The campaign targeted specific individuals, resulting in the compromise of dozens of devices. The exact number of victims is described as dozens, indicating a targeted rather than mass-scale operation. The source material does not specify the professions or identities of the targets, only that they were routed to spyware servers. The zero-click nature of the attack allowed the operators to bypass standard user caution and security awareness.

What happens next for these targets?

No fix or patch has been confirmed for the vulnerabilities exploited in this campaign. Victims of this type of zero-click spyware often require professional digital forensic assistance to determine if their devices remain compromised. The release of technical evidence by The Citizen Lab aims to raise awareness and provide context for security teams. However, without a vendor-provided update or specific mitigation steps released by the researchers, affected users must rely on general security hygiene and monitoring.

What analysts watch for

Security teams usually examine network logs for unexpected connections to advertising domains or known spyware infrastructure. Analysts check whether devices are communicating with servers that do not match legitimate application behavior. Persistence mechanisms often involve modifying system configurations or installing background services that survive reboots. Teams monitor for unusual data exfiltration patterns, such as large outbound traffic volumes to unknown IP addresses. They also review mobile device permissions and installed packages for unauthorized changes.

What to do and how to stay safe: Citizen Lab

• Monitor network traffic for connections to unfamiliar advertising or tracking domains that do not match normal browsing behavior.
• Review installed applications and system services on mobile devices for any unauthorized or suspicious entries that appeared recently.
• Keep operating systems and applications updated to the latest versions once the vendor provides an update to address potential vulnerabilities.
• Consult with cybersecurity professionals if you suspect your device has been compromised by zero-click malware, as standard removal tools may be insufficient.

Step-by-step guide: How Windows Malware Removal Works: The Hidden Persistence Layer

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is AdFection spyware?

AdFection is a sophisticated mercenary spyware campaign that distributes malware through online advertising, allowing infection without user interaction.

Who released the technical evidence for this campaign?

Researchers at The Citizen Lab released the technical details, marking the first proof of this spyware being distributed via ads.

How many devices were infected?

The campaign infected dozens of devices, according to the report published by Wired.