Zero-Click Spyware Ads Reached Phones Without a Click, Researchers Say

What are zero-click spyware ads?

Zero-click spyware ads are advertisements that can trigger an exploit when they render on a targeted device, without requiring the person to tap the ad, download a file, or open a link. Citizen Lab described the technique as “AdFection” in an October 15, 2026 investigation and called it the first public technical confirmation of mercenary spyware delivered through targeted advertising.

The attack path matters because mobile advertising reaches users inside apps, browsers, games, news readers, and other ordinary services. A targeted advertisement may be visible on screen, but Citizen Lab said an ad can also render in the background. That means a person may have no clear sign that an attempted compromise occurred.

Zero-click spyware ads are different from ordinary malicious advertising because the reported campaign involved mercenary spyware, a category of surveillance software generally associated with highly targeted operations. The practical response is not to assume every ad is dangerous. The practical response is to recognize that ad delivery systems can become part of a targeted surveillance chain when attackers abuse them.

Who was targeted in the AdFection spyware campaign?

The AdFection campaign targeted Al Jazeera devices with Candiru spyware during attacks in 2024 and 2025. Citizen Lab linked at least 45 targeted devices with high confidence to Candiru spyware delivered through advertisements purchased by Discover-Tech, an Israeli company.

Candiru has been rebranded as Integrity Labs, according to Citizen Lab’s investigation. The reported targets indicate that the campaign was selective rather than a broad consumer malware operation. A person who sees an ordinary ad should not interpret the report as proof that their phone has spyware.

The targeting model still has wider consequences for mobile security. Advertising infrastructure can distribute content at enormous scale, so a service that reaches many apps and websites can create a large potential delivery surface even when the actual spyware operation focuses on a relatively small group of people. Readers concerned about account compromise can also review common signs of exposed credentials and personal data, although spyware investigations require different evidence and specialist analysis.

How did the targeted ads deliver spyware without a click?

The targeted ads delivered spyware when an attacker-linked ad rendered in an app or browser, according to Citizen Lab. The user did not need to click, install, or otherwise interact with the advertisement for the attack to begin. That technical detail is what makes the campaign a zero-click threat.

Citizen Lab said the advertisements contained attacker-script tags, which are code references that can load content through the advertising process. The report does not mean that every ad using similar technology is malicious. Online advertising depends on complex systems that connect advertisers, exchanges, publishers, apps, and websites, and the reported abuse involved a specific actor and targeted campaign.

Ars Technica reported on October 16, 2026, that Citizen Lab said the attacks affected both iOS and Android devices and were effectively invisible without specialized forensic investigation. The reporting on the cross-platform attacks underscores the central limitation for ordinary users: a normal phone check cannot reliably confirm or rule out sophisticated spyware.

How widely did Discover-Tech ads appear online?

Discover-Tech ads appeared in more than 70,000 mobile apps and more than 120,000 websites from March through June 2026, based on Citizen Lab’s analysis of nearly 4 billion ad-bidding records. The researchers found ads containing attacker-script tags in 75,373 Android and iOS apps and 120,768 websites.

Citizen Lab emphasized that an ad impression does not prove an infection. That distinction is essential because advertising records show where content was delivered, while a spyware infection requires a successful exploit against a particular targeted device. Users should avoid treating a list of affected apps or websites as a list of confirmed unsafe services.

What did ad platforms do after the investigation?

Google terminated Discover-Tech’s access to its ad-exchange platforms after the investigation, and IAB Europe removed Discover-Tech from its vendor registry in early October, according to Citizen Lab. Those actions limit Discover-Tech’s access to named advertising systems, which matters because ad exchanges can connect advertisers with large numbers of apps and websites.

The platform actions do not eliminate the broader security concern. The AdFection investigation shows that targeted advertising can be abused as a delivery mechanism when a surveillance operator obtains access to the relevant ad ecosystem. The most sensible interpretation is that platform enforcement can disrupt a known operation, while researchers and providers still need to identify similar abuse patterns elsewhere.

Advertising systems also collect and process data that affects what people see online. Users who want to reduce personalization can adjust platform controls, including Facebook feed preferences and recommendation controls, but those settings are privacy choices rather than a guaranteed defense against a targeted zero-click exploit.

How can you reduce the risk from zero-click spyware ads?

Zero-click spyware ads cannot be fully avoided through a single phone setting because the reported attacks began when advertising content rendered through ordinary apps or browsers. Keeping the operating system and installed apps updated remains a sensible baseline, consistent with NIST mobile device security guidance, because sophisticated attacks often depend on security weaknesses that vendors later address.

Users can also reduce unnecessary exposure by removing apps they no longer use, reviewing app permissions, and preferring well-maintained software from established stores. Those measures improve general device hygiene, but they do not prove that a device is protected from a highly targeted mercenary spyware operation.

1. Install available operating system and app updates from the device maker and official app store.
2. Remove unused apps, especially apps that no longer receive updates or have no clear purpose.
3. Review sensitive permissions, including microphone, camera, location, contacts, and accessibility access.
4. Use a trusted device and network before changing passwords if you believe an account may be monitored.
5. Document unusual device behavior, suspicious messages, and relevant dates before making major changes.

Stop and seek help from a digital security specialist if you have a credible reason to believe you were specifically targeted because of your work, identity, reporting, activism, legal case, or personal circumstances. Factory-resetting a phone or deleting apps can remove evidence that forensic investigators need, and sudden changes can alert a person conducting surveillance. People facing an immediate safety threat should use a separate safe device and contact local emergency services or a trusted support organization.

What signs should make you seek a forensic review?

Potential spyware victims should seek a forensic review when a credible targeting risk exists alongside suspicious account or device activity. Citizen Lab’s findings show that sophisticated zero-click attacks can be effectively invisible without specialized investigation, so battery drain, crashes, or unusual advertisements alone are not reliable proof of spyware.

A stronger reason to seek specialist assistance includes repeated account takeover attempts, unexpected security alerts, suspicious activity involving sensitive contacts, or evidence that a device may have been targeted because of professional or personal circumstances. A person who believes someone dangerous is monitoring their device should avoid confronting that person through the suspected phone.

Digital safety planning is particularly important in stalking, domestic abuse, workplace retaliation, or politically sensitive situations. The same caution applies to connected devices, because researchers have warned that smart home systems can create additional security exposure when malicious software spreads across connected equipment. Use a safer device to contact a qualified security organization, attorney, employer security team, or digital forensic provider when the situation involves a meaningful threat.

Why does the AdFection finding matter beyond this campaign?

The AdFection finding matters because it documents a route from targeted advertising to zero-click mercenary spyware delivery across mobile apps and websites. Citizen Lab’s analysis connects the advertising infrastructure to a specific spyware campaign, showing that large-scale ad systems can create opportunities for highly selective surveillance operations.

The report does not establish that advertising as a whole is unsafe or that the apps and websites listed in the dataset knowingly participated in spyware delivery. Citizen Lab explicitly said an ad impression alone does not prove infection. That limitation protects readers from drawing the wrong conclusion about individual publishers and app developers.

Citizen Lab’s full AdFection research report provides the technical evidence and the scale of the observed ad-bidding activity. For most people, the immediate lesson is to maintain basic device security and take credible targeting concerns seriously, without confusing ordinary advertising exposure with confirmed surveillance.

FAQ

Can a phone get spyware from an ad without clicking it?

Yes, Citizen Lab said the reported AdFection attacks could begin when an attacker-linked ad rendered in an app or browser, even when the user did not click the ad. The research describes targeted mercenary spyware activity, not proof that all online ads infect phones.

Were all apps that showed Discover-Tech ads infected?

No, an app displaying a Discover-Tech ad does not prove that the app or its users were infected. Citizen Lab found attacker-script tags in 75,373 Android and iOS apps, but it specifically warned that an ad impression alone does not establish a successful compromise.

Did the zero-click spyware ads affect iPhones and Android phones?

Yes, Citizen Lab said the attacks worked on both iOS and Android devices. The reported cross-platform nature means users of either mobile platform should keep software updated and seek specialist help when a credible targeting risk exists.

Should I factory-reset my phone if I am worried about spyware?

No, do not factory-reset a phone before considering whether you need forensic help. A reset can remove evidence needed to investigate suspected targeted surveillance, and sudden changes can create safety risks in situations involving an abusive or dangerous person.

What is Candiru spyware?

Candiru spyware is mercenary surveillance software that Citizen Lab linked with high confidence to the reported attacks on Al Jazeera devices. Citizen Lab said Candiru is now rebranded as Integrity Labs, and the campaign used advertisements purchased through Discover-Tech.