AdFection is the name given by Citizen Lab to a campaign in which mercenary spyware was delivered to journalists through online advertising, requiring no tap, download, or suspicious link.

What makes a zero-click attack different from traditional phishing?

A zero-click attack requires no action from the victim, whereas traditional phishing depends on the victim opening an attachment or tapping a link.

Which companies were identified as facilitating the attacks?

The researchers say two Israeli companies facilitated the attacks, one of which has been on the US blacklist for roughly half a decade; secondary coverage also names an ad company called Discover-Tech.

AdFection: Zero-Click Ad Spyware Journalists Faced in 2024

Q: How was the spyware delivered to the journalists' devices?

The delivery channel was the advertising ecosystem itself, since ads load automatically whenever a page loads, so a malicious ad could reach a device simply because someone visited a website.

Q: Do researchers know who targeted the journalists?

No. The researchers identified the facilitators—two Israeli companies, one of which has been on the US blacklist for around five years—but not the client who chose the targets.

Researchers have documented a case of zero-click ad spyware that journalists encountered in 2024, and it changes how we think about the risks of everyday browsing. Al Jazeera and Citizen Lab have both published findings on a campaign they call "AdFection," in which mercenary spyware was delivered through online advertising. No tap, no download and no suspicious link was needed.

The question of who ultimately targeted the journalists remains unanswered. What the researchers say they do know is who facilitated the attacks: two Israeli companies, one of which has been on the US blacklist for around five years.

How AdFection delivered zero-click ad spyware to journalists

A zero-click attack is one that requires no action from the victim. Traditional phishing depends on you opening an attachment or tapping a link. Here, the delivery channel was the advertising ecosystem itself. Ads load automatically whenever a page loads, so a malicious ad can reach a device simply because someone visited a website.

That is what makes the technique unsettling. The ad network, which most readers never think about, becomes the road the spyware travels on. Targeted advertising is built to pick out specific audiences, and the same precision that lets a brand reach a particular demographic can, in theory, let an attacker reach a particular person.

Public reporting on the research names an ad company called Discover-Tech and describes spyware makers using it to reach devices. Those details come from secondary coverage of the Citizen Lab report, so check the primary findings for the exact technical description before relying on them.

What Citizen Lab and Al Jazeera found

Both organizations released their own findings. Al Jazeera's journalists were among those affected, and Citizen Lab, the research group at the University of Toronto known for investigating commercial spyware, analyzed the campaign and gave it the AdFection name. Our earlier coverage of Citizen Lab's finding that zero-click ads were infecting journalists' devices walks through the report in more detail.

Two points stand out from the reporting:

Attribution is incomplete. The researchers identified the facilitators, but not the client who chose the targets. That is typical of the mercenary spyware market, where the company building the tools and the party using them are often different.
A blacklisted company was involved. One of the two Israeli firms has been on a US blacklist for roughly half a decade. That raises hard questions about how such a company stays connected to commercial infrastructure and the wider ad supply chain.

Secondary coverage has also described the case as the first publicly confirmed instance of zero-click mercenary spyware delivered through targeted ads. Treat that framing as the characterization of Citizen Lab's work as reported by others, and consult the original report for its precise claims.

Why journalists and activists are targeted

Mercenary spyware is sold as a surveillance tool, and journalists are a recurring target because they hold what others want: sources, unpublished material and private communications. A compromised phone can expose contacts, messages, location and microphone access. For a reporter working on sensitive stories, a single infection can put sources at risk, not just the reporter.

The AdFection case also shows why the threat is not strictly limited to journalists. The delivery method relies on infrastructure that everyone uses. Even if a specific person was chosen as the target, the same ad system serves the general public. Most readers are unlikely to be a priority target for this kind of tooling, but the case shows the mechanism exists.

What This Means For You

For most people, the practical risk of being singled out by mercenary spyware is low. Still, the findings are a reminder that clicking nothing does not mean you are safe, and that ordinary web ads can be an attack surface. If you are a journalist, activist, lawyer, or someone who handles sensitive information, take this more seriously.

It is also worth being honest about VPNs. A VPN encrypts your traffic between your device and the VPN server and hides your IP address from the sites you visit. It does not stop a malicious ad from loading in your browser, and it does not patch a vulnerability on your phone. A VPN alone does not protect against this type of attack. It remains useful for other privacy goals, but it is not a defense here.

What readers can do

No single step eliminates the risk, but layered measures reduce it considerably:

Update your operating system and browser promptly. Spyware like this typically depends on software flaws, and updates close them.
Turn on Lockdown Mode if you are at higher risk. Apple's Lockdown Mode is designed to shrink the attack surface for people who may be targeted. Android users can look for comparable advanced protection settings.
Use an ad blocker. If the delivery channel is an ad, blocking ads at the browser or DNS level removes much of the exposure.
Restart your device regularly. Some infections do not survive a reboot, which can force attackers to start over.
Reduce what runs in the browser. Fewer extensions and a minimal set of apps lower the number of places an attacker can exploit.
Seek expert help if you suspect infection. Organizations that support at-risk groups can assist with forensic checks.

Key takeaways

The AdFection case shows zero-click ad spyware journalists faced in 2024 was delivered through the same ad system that serves everyone else. The attacker is still unidentified, but two Israeli companies have been tied to facilitating it. Keep your devices updated, consider Lockdown Mode if you face elevated risk, and block ads where you can. For the complete details, read our summary of Citizen Lab's report on zero-click ads and journalists, then follow the primary findings from Citizen Lab and Al Jazeera. And remember that a VPN, while useful, is not a shield against this kind of attack.