Researchers identify AdFection cyberattacks via digital advertising

Researchers from the University of Toronto have identified a cyberattack method dubbed ‘AdFection,’ where manipulated advertisements are used to deliver spyware to smartphones and other devices. Unlike traditional phishing, this method can infect a device without requiring a user to click on an ad, provided the device has an exploitable security vulnerability.

The investigation, involving findings from Citizen Lab, highlights the role of the Israeli firm Discover-Tech. The company allegedly used advertising spaces to identify specific devices and deliver malicious code. In instances involving Al Jazeera in 2024 and 2025, at least 45 devices were targeted, with researchers confirming infections involving spyware from the firm Candiru.

While ‘malvertising’ is not a new phenomenon—with documented cases dating back to 2016 involving major news outlets—this research underscores the evolving sophistication of using real-time ad auctions to target specific users through IP addresses, cookies, and advertising identifiers.