TL;DR
Researchers at the University of Toronto’s Citizen Lab have uncovered an unprecedented cyber-espionage campaign dubbed “AdFection,” marking what they identify as likely the first confirmed case of zero-click mercenary spyware delivered through targeted commercial advertisements. By exploiting programmatic digital ad networks, the campaign infected 45 devices associated with international media organization Al Jazeera across 2024 and 2025. The operation allegedly leveraged Israeli ad broker Discover-Tech to funnel malicious JavaScript to Candiru-linked spyware servers, silently compromising iOS and Android devices simply as users loaded everyday web pages or mobile apps.
A Stealthy Delivery Mechanism: Zero-Click Exploits in Digital Ads
Commercial spyware operations have long relied on phishing text messages, malicious links, or compromised communications apps to deliver their payloads. However, the newly documented “AdFection” campaign represents a significant shift in threat delivery mechanics. According to a report published Thursday by Citizen Lab, mercenary operators laced targeted online display ads with zero-click exploit code. When an intended target loaded a participating website or opened a mobile application hosting the ad, the exploit triggered automatically—requiring no clicking, tapping, or user interaction whatsoever.
Zero-click exploits are considered among the most dangerous tools in the cybersecurity threat landscape because they eliminate the need to deceive victims into opening suspicious attachments or visiting malicious websites. Once the poisoned advertisement rendered on an individual’s device, the exploit chain initiated invisibly. Citizen Lab emphasized that the resulting infections leave virtually no traces visible to everyday device users, remaining undetectable without specialized forensic software or hardware analysis.
Confirmed Infections at Al Jazeera and Warnings for Global Media
The investigation confirmed that the AdFection campaign successfully compromised 45 mobile devices belonging to personnel at international news network Al Jazeera across 2024 and 2025. Both Apple iOS and Google Android devices were affected during the multi-year operation.
Citizen Lab researchers characterized their findings as an urgent alert for journalists and media institutions worldwide. In their published report, researchers stated:
“This investigation should … serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat. This targeting may happen both in newsrooms and to individual journalists, editors, and other staff members.”
The report further underscored broader geopolitical and institutional implications, noting that “the distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.”
How the Operation Leveraged Programmatic Ad Exchanges
At the center of the delivery pipeline identified by Citizen Lab is Discover-Tech, an Israeli firm that presents itself publicly as a legitimate commercial digital advertising company. Rather than functioning solely as an advertising firm, however, researchers reported that Discover-Tech operated as a facilitator for multiple mercenary spyware vendors, describing this intermediary role as what appears to be the company’s primary purpose.
Digital advertising relies heavily on programmatic real-time bidding (RTB) auctions. When an internet user visits a website or launches a mobile application, ad exchanges instantly broadcast data regarding the user’s mobile advertising identifier, geolocation, IP address, and demographic indicators to potential advertisers. Advertisers then automatically bid on the opportunity to serve an ad to that specific profile.
Citizen Lab reported obtaining and analyzing more than 4 billion ad-bidding records processed by Discover-Tech. The dataset demonstrated that between March and June 2026 alone, Discover-Tech advertisements were served across more than 70,000 mobile applications and over 120,000 websites. By tapping into these demographic profiles, the operators could pinpoint specific individuals of interest and ensure malicious code reached only their devices.
The Connection to Spyware Vendor Candiru
According to the findings, the final mercenary spyware delivered through the AdFection framework was developed and distributed by Candiru, a known commercial surveillance vendor that has rebranded as “Integrity Labs.”
Under the operational arrangement outlined by Citizen Lab, prospective targets matching demographic criteria designated by Candiru’s government or institutional clients were served ads containing specialized JavaScript or other staging code. This code instructed the user’s browser or in-app web view to connect directly with Candiru-operated command-and-control servers. In response, those servers delivered the zero-click exploit payload, completing the silent device compromise.
Citizen Lab’s report did not disclose the precise software vulnerabilities leveraged during the zero-click attacks, nor did it publish technical specifications of the final spyware payload. Reporting from Ars Technica noted that the flaws were likely zero-day vulnerabilities that have since been patched following Citizen Lab’s discovery and coordinated disclosure. Citizen Lab did not immediately respond to requests for additional comment, and inquiries sent to Discover-Tech and Candiru went unanswered.
Ad Ecosystem Exposure Across Government and National Security Networks
The scale of Discover-Tech’s reach within the commercial ad ecosystem extended far beyond news organizations. The report revealed that Discover-Tech ad impressions were recorded within government and national-security-linked networks worldwide. Documented impressions appeared on networks associated with:
- NATO
- United Nations agencies and bodies
- European lawmaking institutions
- Critical infrastructure operators in Australia
- Armed forces and government agencies in Norway and Sweden
Citizen Lab pointed out that Discover-Tech had gained formal recognition within mainstream advertising frameworks, having previously been listed as a certified or verified vendor by Google and the European advertising trade group IAB Europe. Furthermore, the company utilized European Union General Data Protection Regulation (GDPR) consent frameworks to target users across Europe, while routing impressions through prominent ad networks such as Google, Yandex, and Beeswax.
“Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” Citizen Lab concluded.
Industry Reactions and Platform Terminations
Following Citizen Lab’s disclosures, major advertising networks and technology vendors initiated enforcement actions to sever ties with Discover-Tech:
- Google: Removed Discover-Tech from its ad vendor registry and terminated its access to Google ad exchange platforms.
- IAB Europe: Expelled Discover-Tech from its certified vendor listings.
- Beeswax: Removed Discover-Tech from its digital ad buying platform.
- Vungle (Liftoff): Paused Discover-Tech’s platform access while conducting an internal investigation.
- Eskimi: Blocked Discover-Tech’s accounts and affiliated web domains.
Defensive Strategies and Practical Takeaways
The weaponization of commercial ad networks presents substantial challenges for endpoint security, as passive browsing can expose high-value targets to silent intrusion. Citizen Lab called upon ad industry stakeholders and regulatory authorities to implement proactive mechanisms to detect and block malvertising pipelines.
For individual users, civil society members, and enterprise network administrators, researchers and cybersecurity analysts highlighted several concrete mitigating measures:
- Deploy Browser and In-App Ad Blockers: Installing reputable ad-blocking extensions on browsers significantly cuts down the execution of untrusted third-party advertising scripts.
- Reset Mobile Advertising IDs: Regularly resetting the mobile ad identifier in iOS and Android privacy settings disrupts long-term demographic profile aggregation, although users should also consider disabling personalized ad tracking where available.
- Implement Network-Level Ad Filtering: Deploying DNS-based or gateway-level ad blockers on home and corporate Wi-Fi networks prevents malicious ad servers from serving payloads to connected endpoints.
- Maintain Timely Operating System Updates: Zero-click exploits depend on unpatched software flaws in browser engines and mobile operating systems. Rapid installation of official security updates remains essential to neutralizing known attack vectors.
Frequently Asked Questions
What was the AdFection campaign?
AdFection was a targeted cyber-espionage operation identified by Citizen Lab in which commercial online advertisements were weaponized to deliver zero-click exploits and install mercenary spyware on mobile devices without requiring any user engagement.
What makes zero-click exploits delivered via ads uniquely concerning?
Traditional spyware often relies on social engineering, requiring victims to click on suspicious links or open attachments. With zero-click ad delivery, an exploit executes automatically as soon as an ad loads in a mobile app or browser, making the attack invisible to the user and eliminating the human error factor.
Who was confirmed to have been targeted in the AdFection campaign?
Citizen Lab confirmed that 45 devices belonging to staff at international media outlet Al Jazeera were compromised across 2024 and 2025. Researchers also discovered that ad impressions linked to the operation appeared on sensitive networks belonging to NATO, the United Nations, European legislative bodies, Australian critical infrastructure, and Scandinavian armed forces.
What role did Discover-Tech play in the spyware pipeline?
According to researchers, Discover-Tech presented itself as a legitimate digital ad company while acting as a bridge between commercial ad vendors and mercenary spyware makers. The firm leveraged real-time bidding data and mobile demographic profiles to deliver targeted ads containing exploit code to specific victims.
Which spyware developer was linked to the operation?
Citizen Lab reported that the final malware payload was developed and distributed by Candiru (which rebranded as Integrity Labs), whose command-and-control servers delivered zero-click exploits when targeted devices loaded malicious code in ads.
How have major technology and advertising platforms responded?
Google and IAB Europe removed Discover-Tech from their certified vendor registries, with Google terminating the company’s ad exchange access. Other ad platforms, including Beeswax, Vungle, and Eskimi, also removed, paused, or blocked Discover-Tech accounts and domains.
How can users protect against ad-delivered zero-click attacks?
Security researchers recommend using ad blockers on web browsers, resetting mobile advertising IDs in device settings, implementing network-wide ad blocking on office and home networks, and applying operating system security patches as soon as they become available.
0 Comments