The University of Toronto’s Citizen Lab published research Thursday detailing a sophisticated operation that used targeted digital advertisements to distribute mercenary spyware without requiring any user interaction. The campaign, termed AdFection, successfully infected approximately 45 devices belonging to staff members at the international news organization Al Jazeera during 2024 and 2025. The attacks functioned across both iOS and Android platforms, making them particularly difficult to detect without specialized forensic hardware or software.
The malware was delivered through zero-click exploits embedded in advertisements, meaning targets required no action beyond simply loading a website or opening an installed application. Citizen Lab characterized this as likely the first confirmed instance of mercenary spyware distributed via targeted ads. Researchers warned that the technique poses significant risks to news organizations globally, with potential targeting affecting both newsroom operations and individual journalists, editors, and staff members.
The ads were facilitated by Discover-Tech, an Israeli firm presented as a legitimate advertising company but identified by Citizen Lab as operating primarily to broker relationships between mercenary spyware developers and advertisers. The company used bidding processes and extensive user data including mobile identifiers, location information, and IP addresses to target specific demographics. Analysis of over 4 billion bidding records revealed that Discover-Tech advertisements appeared across more than 70,000 mobile applications and 120,000 websites between March and June 2026.
Discover-Tech maintained certifications from major industry players including Google and IAB Europe and operated through platforms such as Google, Yandex, and Beeswax. Following disclosure of the campaign, these companies took corrective action: Google and IAB Europe removed Discover-Tech from vendor registries, Google terminated platform access, Beeswax removed the firm from its buying platform, Vungle paused access pending review, and Eskimi blocked related accounts and domains. Research indicated that Discover-Tech advertisements reached networks affiliated with NATO, the United Nations, European legislative bodies, Australian critical infrastructure, and armed forces and government agencies in Norway and Sweden.
The underlying malware was developed by Candiru, rebranded as Integrity Labs. Citizen Lab did not disclose technical details regarding the specific vulnerabilities exploited or the final malware payloads, suggesting they likely represented previously unknown zero-day vulnerabilities. The organization recommended that users employ ad blockers, reset mobile advertising identifiers in device settings, implement network-level ad blocking, and maintain current software updates.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI