Understanding the AdFection Zero Click Adware Threat

Security researchers have found that a sophisticated cyberespionage campaign delivered spyware to Al Jazeera journalists and others… without them ever clicking a link. The exploit, dubbed "AdFection," operated entirely through digital advertisements that simply had to load on a user's screen to execute the attack.

Let’s examine the situation and what it can tell us about cybersecurity moving forward.

How the AdFection Attack Worked

Unlike traditional phishing campaigns that trick users into clicking shady links or downloading files, this zero-click attack hid a small piece of code in standard online ads. When the ad loaded on a user's screen, the code quietly contacted a server to ask whether the user matched a specific target list.

If the device wasn't on the list, the server returned zero bytes, letting the ad pass security scanners unnoticed. If the device matched, the server immediately deployed a block of malicious code.

Certain Organizations Were Involved

The infrastructure behind the malicious ads was traced to an Israeli firm called Discover-Tech, registered in 2020. On paper, it appeared to be a standard advertising business—with ads running across more than 120,000 websites and 75,000 apps globally—but it quietly facilitated targeted surveillance.

The actual spyware deployed to the targets was linked to Candiru (now operating as Integrity Labs), an Israeli company known for selling advanced surveillance tools to governments.

AdFection’s Impact Has Been Considerable

The attack came to light after Al Jazeera's technology team noticed unusual activity on journalists' devices in 2024, prompting an investigation alongside the Citizen Lab. They discovered that the spyware, once installed on a Windows machine, could modify system settings to survive computer reboots. 

Once active, the malware could steal files, read messages, log keystrokes, capture screenshots, and activate the device's microphone and camera.

This campaign's reach was vast. At least 718 million ad bids carried the hidden code, with heavy targeting concentrated in conflict zones and small states, including Yemen, Montenegro, and the Palestinian territories.

How to Protect Your Business Against This Kind of Attack

Because this attack requires no user interaction, traditional advice like "don't click suspicious links" is ineffective. To mitigate the risk of zero-click ad exploits, experts recommend the following:

• • Use Ad Blockers - Running an ad blocker in your web browser, or blocking ads and trackers at the router level, can prevent malicious ads from loading on your devices in the first place.
  • Update Your Systems - Keeping your systems up to date ensures that the latest security fixes are implemented in your operating systems and applications (especially the web browser).
  • Delete Your Advertising ID - On mobile devices, deleting your advertising ID makes it much harder for targeted campaigns to single you out.
    • On Android, go to Settings > Privacy > Ads > Delete advertising ID.
    • On iOS, go to Settings > Privacy and Security > Tracking, and turn off "Allow Apps to Request to Track."

We’re Here to Help

This shows that protecting your business will only become more complicated and more critical over time. That said, you don’t have to go it alone.

OnSite I.T. specializes in caring for and tending to the technology that businesses in Calgary rely on. Whether you need proactive IT maintenance, comprehensive security, or (most likely) both, our expert team is ready to assist you.

Give us a call at (403) 210-2927 to learn more about our services.