University of Toronto’s Citizen Lab published research Thursday documenting a sophisticated campaign it named AdFection, which delivered advanced malware through targeted advertising to mobile devices running iOS and Android. The campaign is believed to represent the first confirmed instance of mercenary spyware distributed via this vector. The attacks operated silently without requiring any user action, remaining invisible unless detected through specialized forensic tools.
The investigation identified that AdFection infected 45 devices belonging to staff at international media organization Al Jazeera during 2024 and 2025. Citizen Lab researchers emphasized the implications for news organizations globally, warning that similar targeting may be occurring across newsrooms and among individual journalists and editors. The findings highlight a broader security concern for civil society and state actors alike.
Discover-Tech, an Israeli advertising firm, facilitated the malicious campaign by serving as an intermediary between spyware operators and legitimate advertising networks. Operating within standard ad-buying frameworks, the company used bidding processes to target individuals based on demographic data, device identifiers, location information, and other behavioral signals. Between March and June 2026, Discover-Tech-affiliated ads reached over 70,000 mobile applications and more than 120,000 websites.
The malware was created and distributed by Candiru, also known as Integrity Labs. The attack mechanism involved ads containing code that connected to Candiru’s servers, which subsequently delivered zero-click exploits to targeted devices. Several major advertising platforms have since taken action, with Google and IAB Europe removing Discover-Tech from their vendor registries, Beeswax suspending the company from its buying platform, and other ad networks implementing similar restrictions. The research documents how Discover-Tech’s infrastructure appeared on government and national security networks across NATO, the United Nations, European legislative bodies, and defense agencies in multiple countries.
Citizen Lab called for systemic changes to prevent similar abuses, recommending that users employ ad blockers, reset mobile advertising identifiers, and maintain current software updates. The researchers characterized the incident as evidence of fundamental structural vulnerabilities within the online advertising ecosystem that failed to detect or prevent the abuse.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI