Last week, researchers at Citizen Lab revealed a new malware campaign they named "AdFection." According to the Electronic Frontier Foundation's write-up of the findings, the campaign used an ad network to deliver spyware to journalists' devices, infecting them without the target ever needing to click anything. AdFection zero-click spyware malvertising is a reminder that the ads loading quietly in the background of everyday browsing and apps can become an attack path.
The source material available to us is brief, so this post sticks to what has been reported and focuses on the practical questions readers are likely to ask.
How AdFection Delivered Spyware Through an Ad Network
The core of the campaign, as described by the EFF, is the delivery method. Instead of sending a target a suspicious link or attachment, the attackers used an ad network to push spyware to journalists' devices. The target did not have to tap, open, or approve anything.
That is what "zero-click" means: the compromise happens without user interaction. Malvertising, meaning the abuse of advertising systems to deliver malicious content, is not new as a concept. What stands out here is the combination of a trusted, everyday delivery channel with no required action from the victim, aimed at a group that is already heavily targeted.
The EFF describes this kind of attack on journalists as dangerous, and the reasoning is straightforward. Journalists handle confidential sources and sensitive communications, and a compromised phone can expose all of it.
Why Zero-Click Malvertising Matters Beyond Journalists
AdFection was reported as a campaign aimed at journalists, but the mechanism is not exclusive to them. Ad networks reach enormous numbers of people through websites and apps. Any delivery path that relies on that infrastructure raises a broader question about how much exposure ordinary users have to content they never chose to load.
This class of threat also tends to be discussed alongside other zero-click spyware cases. For a recent example, see our report on how Al Jazeera says Candiru-linked spyware hit 45 staff devices, where data was reportedly pulled from journalists' and staff devices without any action by the users.
Most readers are unlikely to be the intended target of a campaign like this. Still, the defenses that reduce risk for high-risk users are often free, built into the device, and worth adopting widely.
What a VPN Does and Does Not Protect Against
It is tempting to assume a VPN solves a problem like this. It is more accurate to be specific about what a VPN does.
A VPN encrypts your traffic between your device and the VPN server and hides your IP address from the sites you visit. That helps with privacy on untrusted networks and with limiting some forms of tracking by IP.
What a VPN does not do, by itself, is stop malicious content that is delivered through the connection once it reaches your device. If spyware arrives through an ad that your browser or app loads, the VPN tunnel simply carries that content like any other traffic. A standard VPN does not patch software flaws, and it does not make your device immune to exploitation.
Some VPN products include optional ad or domain blocking features. Those may reduce exposure to ad content, but they are a layer of filtering rather than a guarantee, and their quality varies. Treat a VPN as one privacy tool among several, not a defense against spyware.
Practical Defenses: Updates, Ad Blockers, and Lockdown Mode
For zero-click threats, a few measures matter most.
- Install updates promptly. Zero-click attacks typically depend on software vulnerabilities. Operating system and browser updates are the most direct way to close them.
- Use an ad blocker. If the delivery path is an ad network, blocking ads removes a chunk of that exposure. Use a reputable blocker, on the browser and, where possible, at the device or network level.
- Enable Lockdown Mode if you are at higher risk. On supported Apple devices, Lockdown Mode is an optional setting that reduces the attack surface for people who may be targeted by sophisticated spyware. It limits some features, which is the trade-off.
- Reduce what runs on your device. Remove apps you do not use, since each one can carry its own ad components.
What This Means For You
If you are a journalist, activist, or someone else who may be targeted, treat AdFection as a prompt to harden your devices now rather than after an incident. If you are an everyday user, the risk of being singled out is lower, but the same habits cost little and protect against many other threats too.
Keep expectations realistic. A VPN is useful for what it is designed to do, but it will not stop ad-delivered spyware on its own. Updates, ad blocking, and Lockdown Mode where appropriate are the steps with the clearest connection to this type of attack.
Takeaways
AdFection zero-click spyware malvertising shows that a campaign can reach a target through ordinary ad infrastructure with no click required. Today, you can:
- Apply pending operating system, browser, and app updates.
- Turn on a reputable ad blocker.
- Enable Lockdown Mode if you are at higher risk.
- Read about the Candiru-linked spyware reportedly found on Al Jazeera devices to see another recent example of the same class of zero-click threat.
None of these steps is complicated, and together they meaningfully raise the bar for attackers.
