Researchers say a new ad-fueled spyware operation used zero-click exploits to install mercenary malware on targeted iPhone and Android devices simply by loading a website or opening an app. The campaign, which Citizen Lab says it has identified as AdFection, appears to be the first confirmed case of zero-click mercenary spyware delivered through targeted ads, and it reportedly infected 45 devices at Al Jazeera in 2024 and 2025.
How the AdFection campaign worked
According to Thursday’s report from the University of Toronto’s Citizen Lab, the attack chain began with targeted mobile advertising. Those ads did not merely profile users for marketing purposes; in some cases, they carried code that triggered an exploit as soon as the ad loaded on a victim’s device.
Citizen Lab said the malicious payload worked on both iOS and Android and required no click, tap, or other interaction from the target. That makes the technique especially concerning, researchers said, because infections are effectively invisible unless a device is examined with specialized forensic tools.
The report says the malware installed through AdFection was developed and distributed by Candiru, which now operates under the name Integrity Labs. In the setup described by the researchers, targets matching profiles of interest to Candiru customers were served ads containing JavaScript or related code that contacted Candiru-controlled servers. Those servers then returned an exploit that delivered the payload automatically.
Why Citizen Lab says this is a major warning sign
Citizen Lab called the findings a warning to news organizations and the people who work for them. In the report, researchers wrote that the investigation should “serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat.” They added that targeting can affect “newsrooms and individual journalists, editors, and other staff members.”
The researchers also said the broader impact extends beyond any single newsroom. “The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large,” the report said.
That concern is tied to the scale and subtlety of ad-tech profiling. In this case, Citizen Lab said the ad brokerage used mobile IDs, location data, IP addresses, and other signals to build highly detailed user profiles. The lab said it obtained more than 4 billion bidding records handled by Discover-Tech, the company it says sat at the center of the operation.
Discover-Tech’s role in the advertising chain
Citizen Lab identified Discover-Tech, an Israeli company that presents itself as a legitimate advertising business, as the broker supplying the ads. The lab said the company functioned as a bridge between advertisers and the mercenary spyware ecosystem, describing that role as appearing to be Discover-Tech’s primary purpose.
In ad-tech terms, the company worked as an intermediary between parties seeking to display ads and publishers or app developers seeking revenue from them. Citizen Lab said the arrangement allowed ads to be delivered to narrowly defined audiences based on demographics and other targeting data.
According to the report, Discover-Tech ad impressions appeared in more than 70,000 mobile apps and over 120,000 websites between March and June 2026. Citizen Lab also said the company used GDPR consent frameworks to target users in the European Union and had served ads through major networks including Google, Yandex, and Beeswax.
What Citizen Lab found in the ad inventory
- More than 4 billion bidding records reviewed by Citizen Lab
- Ads appearing in 70,000-plus mobile apps
- Ads appearing on 120,000-plus websites
- Activity observed between March and June 2026
- Targeting that used mobile IDs, location, IP addresses, and other data
Platform and industry responses
Citizen Lab said a number of ad industry players have already moved against Discover-Tech. Google and the Interactive Advertising Bureau Europe both listed the company as a “certified” or “verified” vendor before removing it from their registries. Google also terminated Discover-Tech’s access to its ad exchange platforms.
Other companies responded as well. Beeswax removed Discover-Tech from its ad buying platform, Vungle, which is part of Liftoff, paused access pending review, and Eskimi blocked the company’s accounts and domains. The report did not say whether any of those companies were aware of the spyware links before Citizen Lab’s findings were published.
Citizen Lab said ad impressions tied to Discover-Tech also turned up on networks associated with governments and national-security institutions around the world, including NATO, United Nations networks, European lawmaking bodies, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden.
Security lessons for publishers and users
The researchers argued that the episode exposes structural weaknesses in online advertising systems, which they said failed to detect or stop the abuse. Their report described Discover-Tech’s conduct as mass abuse, privacy invasion, and facilitation for mercenary spyware attacks.
Citizen Lab urged advertisers and government officials to take concrete steps to prevent similar campaigns. For users, the group recommended ad blockers, resetting the mobile advertising ID in iOS and Android settings, and using ad-blocking software on home or office networks. It also stressed the usual advice: install security updates promptly.
Still, the report leaves important technical details unresolved. Citizen Lab did not identify the vulnerabilities exploited in the zero-click attacks or the final malware that was installed, and said those flaws were likely fixed after the campaign was discovered. Messages sent to Discover-Tech and Candiru went unanswered.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: October 16, 2026 at 10:31 pm
0 views
