A University of Toronto research team announced the discovery of what appears to be the first confirmed case of mercenary spyware distributed through targeted advertisements, according to findings released Thursday. The campaign, designated AdFection, utilized zero-click exploits that installed sophisticated malware on mobile devices simply when users loaded websites or opened applications, requiring no interaction from targets. The attacks affected both iOS and Android platforms and remained invisible unless detected through specialized forensic tools. Citizen Lab confirmed that 45 devices at international media organization Al Jazeera were infected during 2024 and 2025.
The researchers identified Discover-Tech, an Israeli advertising company, as the facilitator behind the campaign. While presenting itself as a legitimate ad vendor, Discover-Tech functioned as a broker connecting those seeking to deploy spyware with advertising platforms and app publishers. The company operated through a bidding system where advertisers paid for placement targeting specific demographic profiles using mobile IDs, location data, and IP addresses. Between March and June 2026, Discover-Tech ads appeared across more than 70,000 mobile applications and 120,000 websites. Major platforms including Google and the industry group IAB Europe had certified Discover-Tech as a verified vendor prior to this discovery.
Following the report, multiple advertising platforms took action against Discover-Tech. Google removed the company from its vendor registries and terminated its access to ad exchange systems. Beeswax removed Discover-Tech from its ad buying platform, while Vungle paused access pending review and Eskimi blocked associated accounts and domains. The research identified that Discover-Tech ad impressions appeared on networks linked to government and national security entities, including NATO, United Nations infrastructure, European legislative bodies, Australian critical infrastructure, and armed forces in Norway and Sweden.
Citizen Lab attributed the malware development and distribution to Candiru, rebranded as Integrity Labs. The arrangement involved targets matching customer profiles receiving ads containing code that connected to Candiru servers, which then delivered zero-click payloads. The researchers did not disclose specific vulnerabilities or final malware details, suggesting they were likely previously unknown exploits subsequently patched. The lab called for advertisers and government officials to implement preventive measures while recommending users employ ad blockers, reset mobile advertising identifiers, and maintain current software updates.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI