Targeted ads delivered 0-click exploits to install mercenary malware

Key Points:

• Researchers at the University of Toronto’s Citizen Lab uncovered a zero-click mercenary spyware campaign called AdFection that infected 45 devices at Al Jazeera in 2024 and 2025 via targeted ads without any user interaction.
• The spyware was delivered through ads brokered by Discover-Tech, an Israeli ad company acting as a facilitator for mercenary spyware vendors, which operated across over 70,000 mobile apps and 120,000 websites between March and June 2026.
• Discover-Tech exploited detailed user profiles assembled from mobile IDs, location, and IP addresses to target individuals, including journalists and government networks worldwide, raising significant privacy and security concerns.
• Major ad platforms such as Google, IAB Europe, Beeswax, and others have since removed or suspended Discover-Tech due to the abuse, highlighting systemic vulnerabilities in the online advertising ecosystem.
• Citizen Lab identified Candiru (Integrity Labs) as the developer of the malware and urged advertisers, governments, and users to take proactive measures such as using ad blockers, resetting advertising IDs, and timely software updates to mitigate risks.