The University of Toronto’s Citizen Lab published findings Thursday detailing what researchers describe as the first confirmed case of mercenary spyware distributed through targeted advertisements. The campaign, designated AdFection, utilized zero-click exploits that installed sophisticated malware on iOS and Android devices when users simply loaded websites or opened applications, requiring no user interaction to succeed.
Citizen Lab’s investigation identified that the attacks compromised 45 devices at international media organization Al Jazeera during 2024 and 2025. The researchers emphasized that the targeting may extend to newsrooms and individual journalists, editors, and other staff members at news organizations worldwide. They characterized the distribution method as a significant security risk to potential victims, states, and civil society broadly.
The malicious ads were facilitated by Discover-Tech, an Israeli advertising company that Citizen Lab describes as operating primarily as a broker between advertisers and the mercenary spyware ecosystem. The company connected parties seeking to display ads with publishers and app developers seeking revenue. Through a bidding process, advertisers could target individuals based on demographic profiles constructed from mobile IDs, location data, IP addresses, and other information. Between March and June 2026, Discover-Tech ads appeared across over 70,000 mobile applications and more than 120,000 websites. The firm had been listed as certified or verified by major vendors including Google and IAB Europe and distributed ads through networks such as Google, Yandex, and Beeswax.
Following the report’s publication, multiple platforms took action against Discover-Tech. Google and IAB Europe removed the company from their vendor registries, with Google additionally terminating its access to ad exchange platforms. Beeswax, Vungle (Liftoff), and Eskimi also suspended or blocked Discover-Tech’s access. The malware itself was developed by Candiru, rebranded as Integrity Labs, which received targeting information through the Discover-Tech arrangement and delivered exploits via ad-served code connected to its control servers.
Citizen Lab documented that Discover-Tech ad impressions appeared on networks linked to government and national security infrastructure, including NATO, United Nations networks, European legislative bodies, Australian critical infrastructure, and armed forces and government agencies in Norway and Sweden. The researchers called for concrete action from advertisers and government officials to prevent similar campaigns and recommended users employ ad blockers, reset mobile advertising IDs, and maintain current software updates.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI