The University of Toronto’s Citizen Lab published research Thursday documenting what it says is the first confirmed case of mercenary spyware delivered through targeted advertisements. The malware campaign, dubbed AdFection, utilized zero-click exploits—attacks requiring no user interaction—that installed sophisticated malware on iOS and Android devices simply when users loaded websites or opened installed applications.
Citizen Lab identified that the campaign infected 45 devices at international media organization Al Jazeera during 2024 and 2025. The researchers emphasized the particular danger posed by such attacks, as they operate invisibly without any visible indication to users unless specialized forensic tools are employed. The lab warned that news organizations globally may face similar targeting of newsrooms and individual journalists, editors, and staff members.
The ads were facilitated by Discover-Tech, an Israeli advertising firm that Citizen Lab characterized as operating primarily as a broker connecting mercenary spyware operators with advertising networks. Through a bidding process, advertisers purchased access to display ads on devices matching specific demographic profiles using mobile identifiers, location data, IP addresses, and other tracking information. Analysis of over 4 billion bidding records showed Discover-Tech displayed ads across more than 70,000 mobile applications and 120,000 websites between March and June 2026. The company held verified vendor status with Google and IAB Europe before being removed from their registries following the report’s publication.
Citizen Lab traced the malware to Candiru, a mercenary spyware developer rebranded as Integrity Labs. Targets matching customer profiles received advertisements containing code that connected to Candiru’s servers, which then delivered zero-click exploits and malware payloads. Ad impressions appeared on networks associated with NATO, the United Nations, European legislative bodies, Australian critical infrastructure, and armed forces in Norway and Sweden.
Following Thursday’s disclosure, Google terminated Discover-Tech’s access to its ad exchange platforms, while Beeswax removed the company from its buying platform. Vungle and Eskimi also suspended or blocked Discover-Tech’s access. Citizen Lab characterized the incident as evidence of structural vulnerabilities in the online advertising ecosystem and recommended users employ ad blockers, reset mobile advertising identifiers, and maintain current software updates.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI