# Zero-click spyware attacks via digital advertising > Live situation record from CLSTR: https://clstr.news/situations/zero-click-spyware-attacks-via-digital-advertising > Updated: 2026-10-23T11:59:08.000Z. Sources: 6. Developments: 2. Cybersecurity researchers have identified a sophisticated method of deploying spyware known as ‘AdFection’. This technique utilizes digital advertising systems to execute zero-click attacks, allowing malicious code to infect devices without any user interaction, such as clicking a link. Research from Citizen Lab links this method to the Israeli advertising technology company Discover-Tech and its ‘Controlium’ platform. The findings suggest that surveillance partners use the platform to profile individuals and target devices, subsequently purchasing advertisements that direct users to spyware developed by Candiru (also known as Integrity Labs). Further reports indicate that iPhone users have been specifically targeted. In one documented case, an employee of a financial institution was targeted through an Instagram advertisement for a football club, resulting in the theft of login credentials and the scanning of cryptocurrency wallets. Additionally, a campaign identified by Report URI involved the use of approximately 630 expired domains. Because these domains remained integrated into the infrastructure of thousands of legitimate websites for services like analytics, roughly 8,000 sites were found to be inadvertently directing visitors to malware infrastructure. ## Timeline ### 2026-10-23: iPhone users targeted by zero-click spyware attacks Cybersecurity researchers have identified zero-click spyware attacks targeting iPhones via Instagram ads and compromised website infrastructures, allowing hackers to steal data without user interaction. 3 sources. https://clstr.news/cluster/iphone-users-targeted-by-zero-click-spyware-attacks ### 2026-10-17: Citizen Lab identifies zero-click spyware attacks via digital ads Citizen Lab has uncovered ‘AdFection’, a zero-click spyware attack technique that uses digital advertising to infect devices without user interaction, involving Discover-Tech and Candiru. 3 sources. https://clstr.news/cluster/citizen-lab-identifies-zero-click-spyware-attacks-via-digital-ads --- Cite as: Zero-click spyware attacks via digital advertising. CLSTR, https://clstr.news/situations/zero-click-spyware-attacks-via-digital-advertising