No click or download required: simply browsing ads on legitimate websites may lead to infection with mercenary spyware

Odaily reports: Bitcoin News posted on X that Citizen Lab researchers have discovered the first publicly documented case of mercenary spyware being delivered through targeted online advertising, in which malicious code can initiate infection once an ad loads, without the user needing to click or download anything. The campaign is called "AdFection." At least 45 Al Jazeera devices were targeted between 2024 and 2025, and the operation has been linked to Israeli advertising company Discover-Tech and spyware vendor Candiru.

After analyzing approximately 4 billion ad bidding records, researchers found that Discover-Tech's ads had appeared on nearly 200,000 websites and apps worldwide, but ad exposure does not necessarily lead to infection. Discover-Tech previously conducted business through major ad networks, including Google, and was removed after the investigation.