本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads

On Thursday, researchers from The Citizen Lab at the University of Toronto revealed a worst-case scenario found in the wild: spyware silently infecting targets as they browse past ads in their daily digital lives.

周四，多伦多大学公民实验室（The Citizen Lab）的研究人员揭露了一种在现实中发现的最坏情况：间谍软件在目标用户浏览日常数字生活中的广告时，会静默地感染其设备。

Dubbing the attacks “AdFection,” the researchers documented a campaign in which an Israeli-registered advertising firm allegedly connected to the servers linked to a spyware company and infected dozens of devices with its invasive malware. Citizen Lab believes this to be the first detailed technical evidence made publicly available of sophisticated spyware infecting devices via digital ads.

研究人员将这些攻击命名为“AdFection”，并记录了一场活动：一家在以色列注册的广告公司据称连接到了与某间谍软件公司有关的服务器，并用其入侵性恶意软件感染了数十台设备。公民实验室认为，这是目前公开的关于复杂间谍软件通过数字广告感染设备的首个详细技术证据。

Zero-click hacks are a holy grail for attackers and catastrophic for victims, because they can automatically install malware on devices without requiring any interaction or missteps from the target. When sophisticated hackers have deployed rare zero-click attacks in recent years, they have often exploited vulnerabilities in mobile messaging and communication apps to infect victims. But attackers have also exploited the sprawling infrastructure of the online ad ecosystem to distribute malware, sometimes with little or no interaction needed from victims. Evidence of the zero-click spyware campaign that Citizen Lab’s researchers uncovered shows the two threats merging, underscoring the extent and urgency of the risk.

“零点击”黑客攻击是攻击者的终极目标，对受害者而言则是灾难性的，因为它们可以在无需目标用户任何交互或失误的情况下，自动在设备上安装恶意软件。近年来，当高级黑客部署罕见的“零点击”攻击时，他们通常利用移动消息和通信应用中的漏洞来感染受害者。但攻击者也利用了在线广告生态系统庞大的基础设施来分发恶意软件，有时受害者几乎不需要进行任何交互。公民实验室研究人员发现的“零点击”间谍软件活动证据表明，这两种威胁正在融合，凸显了风险的广度和紧迫性。

“AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet,” says Bill Marczak, a senior researcher at Citizen Lab. “Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all.”

“AdFection 允许操作者在特定个人使用应用程序或浏览互联网时，利用雇佣间谍软件自动对其进行黑客攻击，”公民实验室高级研究员比尔·马尔扎克（Bill Marczak）表示。“以这种方式被黑的人不会察觉到任何异常。事实上，他们甚至可能根本看不到任何广告。”

The situation is so concerning, he notes, because there isn’t much that people can do to protect themselves from zero-click ad attacks other than blocking ads as thoroughly as possible on all websites and platforms—a fact that intelligence agencies like the NSA and CIA seem to know all too well.

他指出，这种情况之所以令人担忧，是因为除了在所有网站和平台上尽可能彻底地屏蔽广告外，人们几乎没有其他办法来保护自己免受“零点击”广告攻击——这一点似乎连美国国家安全局（NSA）和中央情报局（CIA）等情报机构都非常清楚。

“The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario,” says Wolfie Christl, a senior Citizen Lab researcher.

“仅仅因为使用显示广告的网站或应用程序就导致设备感染间谍软件，这种风险简直是噩梦般的场景，”公民实验室高级研究员沃尔菲·克里斯托（Wolfie Christl）说道。

During 2024 and 2025, Citizen Lab concluded that 45 devices belonging to the news outlet Al Jazeera were targeted with zero-click attacks delivered by ads. The researchers say that the targeted ads were issued by the Israeli-founded marketing firm Discover-Tech and distributed spyware attributed to the Israeli developer Candiru. Infected devices had contact with domains linked to Discover-Tech and then connected to infrastructure associated with Candiru, according to Citizen Lab’s analysis. (Al Jazeera, which participated in the investigation and shared device logs with Citizen Lab researchers, did not respond to a request for comment.)

在 2024 年和 2025 年期间，公民实验室得出结论，半岛电视台（Al Jazeera）新闻机构的 45 台设备遭到了通过广告投放的“零点击”攻击。研究人员称，这些定向广告由以色列创办的营销公司 Discover-Tech 发布，并分发了归属于以色列开发商 Candiru 的间谍软件。根据公民实验室的分析，受感染的设备曾与 Discover-Tech 关联的域名进行过通信，随后连接到了与 Candiru 相关的基础设施。（参与了此次调查并与公民实验室研究人员共享设备日志的半岛电视台未回应置评请求。）

“The ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem, and is perfectly suited to the mercenary spyware industry,” Marczak says. “Until this architecture changes, or ad companies get serious about customer vetting, we’re going to keep seeing this kind of abuse.”

“向特定用户推送个性化、任意内容的能力是现代在线广告生态系统的标志，也非常适合雇佣间谍软件行业，”马尔扎克说。“除非这种架构发生改变，或者广告公司认真对待客户审查，否则我们将持续看到这种滥用行为。”

Emails and messages sent to Discover-Tech and its CEO by WIRED did not receive a response before publication. Integrity Partners, which is believed to own Candiru’s assets, following sanctions by the US government in 2021, also did not respond to requests for comment.

《连线》（WIRED）在文章发布前向 Discover-Tech 及其首席执行官发送的电子邮件和信息未得到回复。在 2021 年美国政府实施制裁后，被认为拥有 Candiru 资产的 Integrity Partners 也未回应置评请求。

Google, which operates one of the world’s largest advertising businesses, terminated Discover-Tech’s registration after collaborating with Citizen Lab and researchers from the cybersecurity firm Confiant and confirming a spyware link. “Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies,” a Google spokesperson says. “We also set up Safe Browsing warnings to help protect people if they navigate to websites linked to this group.”

谷歌运营着全球最大的广告业务之一，在与公民实验室及网络安全公司 Confiant 的研究人员合作并确认存在间谍软件关联后，终止了 Discover-Tech 的注册。“在与公民实验室和 Confiant 进行联合调查后，谷歌因 Discover-Tech 系统性地违反了我们的政策，将其从我们的广告平台中封禁，”谷歌发言人表示。“我们还设置了‘安全浏览’警告，以帮助保护用户在访问与该组织关联的网站时免受侵害。”

The European branch of the Interactive Advertising Bureau (IAB), an ad industry body, confirmed to WIRED that it has suspended Discover-Tech from its global vendor list, known as the GVL. The company was suspended by IAB Europe following an audit of its policies, it says. “Further confirmation of the findings regarding spyware could also justify a definitive expulsion from the GVL,” a spokesperson for IAB Europe says.

广告行业机构互动广告局（IAB）的欧洲分部向《连线》证实，已将 Discover-Tech 从其全球供应商名单（GVL）中暂停。该机构表示，在对其政策进行审计后，IAB 欧洲分部暂停了该公司的资格。“如果关于间谍软件的调查结果得到进一步证实，可能足以将其从 GVL 中永久除名，”IAB 欧洲分部的发言人表示。

A spokesperson for Beeswax, an online advertising industry company owned by Comcast, says in a statement: “Beeswax removed Discovery-Tech from our platform following recent activity and independent validation by a third-party security specialist. We maintain a zero-tolerance policy for malicious advertising.”

康卡斯特（Comcast）旗下的在线广告行业公司 Beeswax 的发言人在一份声明中表示：“在近期活动及第三方安全专家的独立验证后，Beeswax 已将 Discovery-Tech 从我们的平台中移除。我们对恶意广告保持零容忍政策。”

Often when you see ads online or in apps, they’re displayed following a complex process known as real-time bidding—essentially an automated auction where advertisers place bids to show you specific ads. The milliseconds-long process can result in advertisers collecting huge volumes of data about your device, your location, and browsing history, plus a whole lot more. The process has been a privacy nightmare for years, with murky data brokers selling people’s personal information, and law enforcement agencies and hostile nations buying it to track or target people.

通常，当你在网上或应用程序中看到广告时，它们是通过一种称为“实时竞价”的复杂过程显示的——本质上是一个自动化拍卖，广告商通过竞价来向你展示特定广告。这个仅需几毫秒的过程可能导致广告商收集关于你的设备、位置、浏览历史以及更多的大量数据。多年来，这一过程一直是隐私方面的噩梦，模糊的数据经纪人出售人们的个人信息，而执法机构和敌对国家则购买这些信息来追踪或锁定目标。

The Citizen Lab researchers say that Discover-Tech operates an advertising platform, Controlium, that can allow its users to “de-anonymize, fingerprint, and automatically infect devices” once an ad appears. Overall, the researchers estimate that millions of devices were directed to Candiru’s servers, where they could be profiled. By analyzing ad-bidding records that were publicly exposed on the Discover-Tech website, the Citizen Lab researchers say, ads linked to the firm with attacker script tags were shown in more than 70,000 mobile apps and more than 120,000 websites between March and June this year. Multiple apps, the researchers say, displayed more than a million ads linked to Discover-Tech.

公民实验室的研究人员表示，Discover-Tech 运营着一个名为 Controlium 的广告平台，该平台允许其用户在广告出现时“去匿名化、进行指纹识别并自动感染设备”。总体而言，研究人员估计有数百万台设备被引导至 Candiru 的服务器，并在那里被建立档案。通过分析 Discover-Tech 网站上公开暴露的广告竞价记录，公民实验室的研究人员称，今年 3 月至 6 月期间，与该公司关联且带有攻击者脚本标签的广告在超过 7 万个移动应用程序和 12 万个网站上显示。研究人员称，多个应用程序显示的与 Discover-Tech 关联的广告超过了 100 万条。

The firm’s ads weren’t necessarily all weaponized to potentially distribut

该公司的广告并不一定全部被武器化以用于潜在的分发。