多伦多大学公民实验室（Citizen Lab）揭露了一项名为「AdFection」的零点击间谍软体攻击行动，这是首次公开且具备详细技术证据的案例，显示精密间谍软体能透过日常数位广告在无需使用者点击或互动的情况下，悄然感染目标设备。在2024至2025年间，研究人员发现半岛电视台（Al Jazeera）的45部设备遭到此类针对性广告锁定，这些恶意广告由以色列注册的行销公司Discover-Tech发布，并将受害设备连线至以色列间谍软体开发商Candiru相关的基础设施以植入恶意程式。
现代数位广告生态系统仰赖即时竞价（RTB）机制，在毫秒间收集大量装置与个人数据并向特定对象推送内容，这种架构恰好被佣兵间谍软体产业利用。研究指出，Discover-Tech营运的广告平台Controlium能在广告显示时对设备进行去匿名化、指纹识别与自动感染；透过分析公开曝露的竞价纪录，带有攻击脚本标签的相关广告曾出现在超过7万个行动应用程式与12万个网站上，使数百万台设备被导向Candiru伺服器进行剖析，甚至连北约、联合国及欧美澳等多国政府与国安网路也曾出现该公司的广告曝光。
针对此一严重的资安威胁，Google在与公民实验室及资安公司Confiant合作调查后，已封锁Discover-Tech的广告平台帐户并设立安全浏览警告；欧洲互动广告局（IAB Europe）与Comcast旗下的Beeswax也分别将其从全球供应商名单中停权及移除。专家警告，由于一般个人网路缺乏如企业般的严密网路日志监控，此类攻击过去极难被察觉，在广告架构改革或加强客户审查前，使用者除了尽可能全面封锁广告外，几乎难以自我保护，这也对开放网路的信任基础构成深远打击。
The Citizen Lab at the University of Toronto uncovered a zero-click spyware campaign dubbed "AdFection," providing the first detailed publicly available technical evidence of sophisticated spyware silently infecting devices via everyday digital ads without requiring any user interaction. Between 2024 and 2025, researchers found that 45 devices belonging to the news outlet Al Jazeera were targeted by malicious ads issued by the Israeli-registered marketing firm Discover-Tech, which directed infected devices to infrastructure associated with the Israeli spyware developer Candiru.
The modern online advertising ecosystem relies on real-time bidding (RTB) to collect vast amounts of device and personal data in milliseconds and push individualized content to specific users, an architecture ideally suited for abuse by the mercenary spyware industry. Researchers revealed that Discover-Tech operates a platform called Controlium capable of de-anonymizing, fingerprinting, and automatically infecting devices upon ad display; bidding records showed that ads with attacker script tags appeared across over 70,000 mobile apps and 120,000 websites, directing millions of devices to Candiru servers for profiling and generating ad impressions even on networks linked to NATO, the UN, and various national security agencies. (Key numbers: 7, 12)
In response to these findings, Google terminated Discover-Tech's registration on its ad platforms and implemented Safe Browsing warnings following a joint investigation with Citizen Lab and Confiant, while IAB Europe and Comcast-owned Beeswax also suspended or removed the firm from their platforms. Experts warn that because personal networks lack extensive monitoring logs like those that helped uncover the Al Jazeera attacks, such threats often go undetected, leaving users with little protection other than thorough ad blocking until the ad industry reforms its architecture and vetting processes.