Citizen Lab has uncovered AdFection, an operation delivering Candiru spyware via malicious ads, in zero-click attacks.