Citizen Lab finds AdFection zero-click ad spyware; Google, IAB Europe act

New research from Citizen Lab uncovers "AdFection," a zero-click spyware attack delivered through targeted ads — simply viewing an ad can be enough to infect a device. The report implicates Discover-Tech, whose ads appeared across 120,000 websites and 75,000 apps from March to June 2026 and delivered spyware to at least 45 devices at Al Jazeera between 2024 and 2025.

Brave amplified the findings on X, noting the ads can identify or track users whenever they load. Google has since cut off Discover-Tech's access to its ad platforms and IAB Europe suspended it from its vendor list, but Brave argues these actions don't fix the systemic vulnerabilities — third-party code running from ads and data-rich ad auctions — that enabled the spyware to spread.