The Citizen Lab

The Citizen Lab, a University of Toronto digital rights research unit, reports that governments are exploiting online advertising networks to infect targets with 'zero-click' spyware. It found evidence that dozens of devices at the media organization Al Jazeera were hacked after staff were shown malicious ads, with no interaction required. The findings renew scrutiny of commercial spyware and state-backed hacking of journalists.

Researchers at The Citizen Lab have released technical evidence, for the first time, that sophisticated mercenary spyware is being distributed to phones through online advertising, infecting devices without any click or user interaction. The findings are being called a nightmare scenario for mobile security, since ad networks could deliver spyware to targets at scale. Security experts are urging closer scrutiny of the adtech supply chain.

Researchers at Citizen Lab report on AdFection, a technique in which disinformation-tech actors turned targeted advertising into a delivery pipeline for zero-click spyware, meaning victims could be infected without clicking anything. The findings raise fresh concerns about the ad-tech ecosystem being exploited for surveillance and are prompting discussion about platform accountability and the security of programmatic ad delivery.

Researchers at the University of Toronto's Citizen Lab say Israeli firm Discover-Tech uses digital advertising to deliver its Controlium spyware. The software allegedly lets clients mass-profile internet users before covertly hacking selected targets without any clicks from the victim. The findings raise fresh concerns over commercial spyware being sold to private clients and the abuse of online ad networks for surveillance.

The Citizen Lab has published a report describing "AdFection," an operation in which ad-targeting technology was allegedly exploited to deliver zero-click mercenary spyware to targeted individuals' devices. The findings point to abuse of the digital advertising ecosystem as an infection pipeline, raising fresh concerns about surveillance-for-hire firms and the security of online advertising infrastructure.