> ## Content Index > Fetch the complete content index at: https://blog.era-wallet.com/llms.txt > Use this file to discover other available public pages before exploring further. # AdFection: Targeted Ads Became a Zero-Click Infection Path - URL: https://blog.era-wallet.com/adfection-zero-click-spyware-targeted-ads/ - Published: 2026-10-19T14:34:18.000Z - Updated: 2026-10-19T14:34:18.000Z - Author: ERA WALLET - Tags: Cybersecurity, Crypto Security, Spyware, Hardware Wallets On October 15, [Citizen Lab](https://citizenlab.ca/research/exposing-adfection-executive-summary/?ref=blog.era-wallet.com) published a report on AdFection, a scheme in which a single targeted ad impression may have been enough to infect a device without any user click. The researchers link the infrastructure to Discover-Tech and to the delivery of Candiru spyware on Al Jazeera devices. The report says at least 45 devices inside Al Jazeera’s newsroom were affected in 2024–2025. For crypto wallet users, the significance goes beyond the espionage campaign itself. A device can be attacked before you open your wallet, tap a button, or sign a transaction. That is a different security layer: protecting the phone or computer itself versus protecting the transaction signature. ## **How the scheme worked** Citizen Lab describes a chain in which ad infrastructure was used not only for targeting, but also as a delivery channel for malicious code. In the report, a simple ad impression could be enough to trigger infection, and in some cases code loaded in the background without any obvious user interaction. The researchers say the NOAS ad server returned JavaScript only to selected devices; if a target was not selected, the server could return an empty 0-byte response. Citizen Lab also notes the scale of the Discover-Tech ad network: the ads were shown in nearly 200,000 Android/iOS apps and websites, and there were nearly 4 billion bidding records. That matters not just as a raw number, but as a sign of how broadly the ad ecosystem can distribute code and collect device signals. In simplified terms, the sequence looked like this: a user saw a targeted ad, the ad infrastructure delivered JavaScript code to selected devices, the code then triggered further interaction with Discover-Tech infrastructure, and the device then connected to a Candiru validator server and later to command infrastructure. Citizen Lab describes the chain as ad impression → contacts with Discover-Tech domains → connection to the Candiru validator server → then C&C. Here, zero-click means without a user click, not without any conditions or traces. It is still a technical attack on the device; it just does not need the victim to click anything to begin. ![](https://storage.ghost.io/c/ce/8d/ce8db2a5-44fe-4b14-a909-c806ae2eb88e/content/images/2026/10/486448.png) ## **Why this matters for crypto users** Most people think about wallet risk in familiar terms: don’t click phishing links, don’t sign suspicious transactions, don’t share your seed phrase. That still holds. But AdFection points to another layer of risk: a device can be compromised before any click happens. That does not mean an attacker automatically gets your seed phrase or instantly drains funds. Citizen Lab does not present direct evidence of seed-phrase theft, attacks on crypto wallets, or compromise of the transaction-signing process. But if a phone or computer is already infected, it can become a staging ground for later attacks: address substitution, session hijacking, covert surveillance, or misleading information inside the interface. That is a risk assessment, not a claim that this is how the AdFection campaign itself operated. So the important distinction is between a device being compromised and the layer where you confirm a transaction being compromised. They are not the same thing. You can avoid signing anything malicious and still end up with an infected phone or laptop. ## **What is known about the campaign against Al Jazeera** Citizen Lab gives the most detail about the campaign against Al Jazeera. According to the report, the outlet was targeted by a series of attacks in 2024 and 2025 that the researchers connect to Candiru through Discover-Tech ads. At least 45 devices inside Al Jazeera were affected. The report also says Al Jazeera isolated a DLL with hardcoded C&C servers matching Fingerprint C1\. That is a detail of this specific investigation, not a universal feature of all such attacks. ## **What this means in practice** For everyday crypto users, the lesson isn't that online advertising is inherently dangerous. It's that security needs to begin before you even open your wallet. If your phone or computer is compromised by spyware, the risk may extend beyond your browser or messages. Malware could potentially manipulate wallet interactions, substitute recipient addresses, or mislead you about the transaction you're about to sign. This is why separating transaction preparation from transaction signing matters. A software wallet lets you manage your assets and prepare transactions, while an air-gapped hardware wallet keeps private keys isolated and signs transactions on a separate device without a direct internet connection. When transactions are transferred via QR codes, the phone does not gain direct access to the hardware wallet's private keys. But isolation alone isn't enough. A compromised phone can still prepare a malicious transaction and present it for signing. That's why independent verification matters. With ERA Wallet, [ERA Lens](https://blog.era-wallet.com/how-era-lens-works-verify-crypto-transactions-before-you-sign/) decodes supported transaction data offline, directly on the hardware device, helping users understand what they're being asked to approve before signing. This doesn't make any wallet immune to every attack. It creates an additional security boundary that doesn't depend entirely on the integrity of your phone or computer. [![CTA Image](https://storage.ghost.io/c/ce/8d/ce8db2a5-44fe-4b14-a909-c806ae2eb88e/content/images/2026/07/5773904739-3.webp)](https://era-wallet.com/?utm%5Fsource=blog&utm%5Fmedium=article%5Fcta&utm%5Fcampaign=rad-20261018-03&utm%5Fcontent=inline%5Fcta%5F01) Keep your private keys isolated from your everyday devices. Add an independent layer of security with ERA Wallet. Use code ****ERABLOG20** for 20% off. [Explore ERA Wallet ](https://era-wallet.com/?utm%5Fsource=blog&utm%5Fmedium=article%5Fcta&utm%5Fcampaign=rad-20261018-03&utm%5Fcontent=inline%5Fcta%5F01) ## The bottom line AdFection isn't a story about bad advertising. It's about ad infrastructure becoming a channel for stealthy device infection - before the user even clicks anything. For crypto users, the lesson goes beyond protecting seed phrases, verifying addresses, and signing carefully. These practices still matter, but they shouldn't depend entirely on the security of your phone or computer. **The real question isn't whether you can trust your device. It's what remains secure if you can't.** ## **Sources** - [Citizen Lab - Executive Summary: Exposing AdFection](https://citizenlab.ca/research/exposing-adfection-executive-summary/?ref=blog.era-wallet.com) - [Citizen Lab - How Discover-Tech Turned Targeted Ads into a Pipeline for Spyware](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/?ref=blog.era-wallet.com)