Citizen Lab has released findings on a new spyware investigation. The research says high-level users in government, tech, energy, and other critical sectors are being targeted.
While average users do not appear to be targets, this new investigation reveals once again how global online ad systems can be manipulated by bad actors, spyware vendors, and malicious threat actors, and how zero-click spyware campaigns hack into users’ devices using ads.
AdFection attacks impact millions in a wide range of countries
On October 15, Citizen Lab released its new investigation on AdFection, calling it “the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.” Citizen Lab says AdFection attacks impacted millions of people in dozens of countries.
Using ads and the global online ad bidding and publishing systems maliciously is nothing new. Neither is the use of zero-click ad spyware attacks. In these types of campaigns, all you have to do is watch an ad, and your device is breached with spyware. No clicks necessary.
Back in April 2026, another Citizen Lab report found that Weblock was doing something similar. This new Citizen Lab investigation says that the company Discover-Tech developed a platform that turned the global online ad system into a pipeline for zero-click mercenary spyware and other data intelligence-gathering operations.
Using this platform, threat actors can take a spearphishing approach to display ads to specific groups, filtering them by country, IPs, websites, domains, and other filters.
The platform is called Controlium, and Citizen Lab says it is developed and operated by Discover-Tech, an Israeli company that “presents itself as a legitimate advertising company, but which they found operates as a facilitator for multiple mercenary spyware partners.”
The platform Controlium, says Citizen Lab, mostly shows ads to Android and iOS devices, but it can also show ads on web browsers, affecting desktop computers and other devices.
The ads were shown on Google’s network, Yandex, Beeswax, TripAdvisor, AccuWeather, and news sites in countries around the world, including regions from the Middle East, Europe, the United States, and Central and South America.
How AdFection ads breach devices
Once Controlium ads are shown on a user’s screen, they are coded to “check in” with an attacker-controlled server, which then automatically decides if the user is a target or not. If so, the ad fetches a JavaScript from the server that breaches your device. Operators who lease the platform Controlium to Discover-Tech can customize this JavaScript.
This technique contrasts with other zero-click ad spyware delivery techniques because the malicious code is not embedded into the ad or image itself but hosted on a server, which can fingerprint users and devices whether or not they are worth breaching.
Who has AdFection targeted so far?
According to Citizen Lab, besides governments and high-level users that work in national security sectors, big tech professionals in the chip and superconductor industry were also targeted.
“We found what appears to be a nexus among the advanced semiconductor industry, covering the chain from design, memory, to chip development and fabrication, with the greatest number of impressions seen in Intel networks, alongside Nvidia, SanDisk, Texas Instruments, Broadcom, Micron Technology, and ARM,” says Citizen Lab.
“We also identified impressions within the networks of large US tech firms including Apple, Microsoft, and Motorola,” says Citizen Lab.
Some of the countries where ads were shown include Armenia, Australia, Azerbaijan, Belgium, Bhutan, Brazil, Colombia, Czechia, Denmark, France, Germany, Greece, Hungary, Indonesia, Israel, Italy, Kosovo, Latvia, Libya, Macedonia (North Macedonia), Malaysia, Mexico, Montenegro, Norway, Pakistan, Poland, Portugal, Russia, Serbia, Singapore, Somalia, Spain, Sweden, Thailand, the United Arab Emirates (UAE), the United States, and Uruguay.
Citizen Lab explains that after disclosing its findings to relevant companies and organizations, Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi disconnected Discover-Tech’s access to their digital advertising ecosystem.
Other ad vendors have yet to respond.
Data deanonymization, spyware, and intelligence actors linked to AdFection
Some of the threat actors using this new technology include DARK CARTOGRAPHER, which works in mass deanonymization using these malicious ads. Deanonymization is the practice of linking anonymous user data to real identities. Other spyware and intelligence threat actors linked in this investigation to Discover-Tech’s ads include Candiru, Intelos, and Bindecy.
“The fact that Discover-Tech was able to bid on and show ads on these (national-security high-level users) networks highlights the systemic risk posed by AdFection and the advertising ecosystem, and warrants urgent investigation to determine whether any users on these networks were infected with spyware,” says Citizen Lab.
The Citizen Lab investigation is thorough, detailed, and highly technical, and it includes attribution. You can read the full report here.
Why does AdFection matter to you? And why should it matter to everyone?
While these type of high-level threat campaigns typically target high-level users, meaning the average user may have little to no contact with these threats ever, Citizen Lab says you could still be impacted by a broken global digital ad infrastructure system that can be weaponized against users.
“Dozens of reports by numerous organizations, including the Citizen Lab, have shown incontrovertible proof of the harms caused by mercenary spyware vendors on civil society around the globe,” Citizen Lab adds.
Citizen Lab says their findings “reveal a troubling lack of due diligence within the digital advertising industry that helps enable inappropriate activity.” For example, they say “Discover-Tech was verified and approved to connect with global leading ad companies like Google and IAB Europe for years, from 2020 to 2026.”
“Our findings show that the digital advertising industry is ill-prepared to prevent malicious actors from exploiting its infrastructure for the distribution of spyware via targeted ads,” says Citizen Lab.
“The online advertising industry must get serious about tackling the distribution of mercenary spyware via targeted ads, alongside other malicious advertising practices including financially motivated fraud and cybercrime,” Citizen Lab adds.
How to stay safe from spyware and other risks of the global online ad industry
Besides spyware and malicious actors, many vendors and systems track your data. So, how can you stay safe and keep your data more private?
Use ad blockers and privacy-first browsers
No matter what industry you work in, ad blockers and privacy-first browsers like DuckDuckGo and Tor can go a long way toward securing your data and making it more private. Check out which ad blocker and private browser is the best fit for you to lead a more ad-free, browser-private life.
Ads are not safe: The zero-trust, no-ad-click user security habit
These days, clicking on ads is not a good idea. From macOS stealer campaigns to sophisticated high-level spyware, threat actors use ads in different ways to get your attention and hack your device.
If you see an ad for something that interests you, go to the official site instead of clicking on it. This approach, combined with a zero-trust, no-ad-click security habit, appears to be the fix to the ad problem. At least, it will be until the advertising industry figures out how to bridge the cracks through which malicious actors slip through.
This tactic, however, does not hold up against zero-click attacks, where an ad simply needs to load on your device to breach it.
Get Moonlock: Layers of Mac privacy and security defense
The Moonlock security app was developed to offer you layers of Mac defense that can help you build up your privacy and security. Once installed, run the Malware Scanner. Meanwhile, Real-Time Protection will run in the background, checking everything you interact with for malware or suspicious behaviors.
Real-Time Protection will protect against threats in emails, websites, downloads, and even terminal commands. If it finds something off, it will let you know what it is and why it is dangerous, and move it to a Quarantine where you can check out the threats your Mac encountered in your own time and remove them completely from your computer.
To add layers of protection, the Moonlock app ships with a built-in VPN for safe browsing, and through Network Inspection, you can cut off connections to specific countries where you are worried about how actors might handle your data.
Additionally, the Moonlock app’s System Protection can guide you through how to turn up your Mac privacy and security controls to higher settings. And with the Security Advisor, Moonlock helps you build safe digital habits in your own time.
You can check out and test-drive Moonlock for free for 7 days.
Final thoughts
Once again, another Citizen Lab investigation reveals that the spyware industry is innovating — and is highly active.
While law enforcement, authorities, and courts take action against AdFection, users have been given a glimpse of how global ad systems are being manipulated and abused once again. This time, it’s a spyware ad platform that allows threat actors to “spear-phish” through their ad campaigns, with highly customizable features and JavaScript attacker servers and fetchers.
This is an independent publication, and it has not been authorized, sponsored, or otherwise approved by Apple Inc. Mac, iPhone, iOS, and macOS are trademarks of Apple Inc.
