A research team at the University of Toronto’s Citizen Lab published findings Thursday describing what appears to be the first confirmed case of mercenary spyware distributed through targeted advertisements. The campaign, labeled AdFection, deployed zero-click exploits that infected devices running iOS and Android operating systems. Notably, the attacks required no user interaction—targets became infected simply by viewing websites or using installed applications. The malware installations went undetected unless users employed specialized forensic tools.
Citizen Lab documented that 45 devices at international news organization Al Jazeera were compromised during 2024 and 2025. The researchers emphasized the particular threat this poses to news organizations and journalists globally, warning that similar targeting campaigns may be occurring in newsrooms and affecting individual staff members. The distribution method represents a significant security concern extending beyond direct victims to include implications for states and civil society.
Discover-Tech, an Israeli advertising company, facilitated the campaign by serving as a broker between advertisers and mercenary spyware operators. Operating through standard ad bidding mechanisms, the company assembled detailed profiles of millions of users based on mobile identifiers, location data, and IP addresses. Citizen Lab accessed over 4 billion bidding records showing Discover-Tech ads appeared across more than 70,000 mobile applications and 120,000 websites between March and June 2026. Major advertising platforms including Google and IAB Europe had certified Discover-Tech as a verified vendor.
The malware was developed and distributed by Candiru, a mercenary spyware company rebranded as “Integrity Labs.” Targets matching specific profiles of interest to Candiru clients received advertisements containing code that connected to Candiru control servers, which then delivered zero-click payloads. Following the discovery, Google, IAB Europe, Beeswax, Vungle, and Eskimi all removed or suspended Discover-Tech’s access. Citizen Lab documented Discover-Tech ad impressions appearing on networks associated with NATO, the United Nations, European legislative bodies, Australian infrastructure providers, and government agencies in Norway and Sweden.
Citizen Lab called for concrete action from advertisers and government officials while recommending users employ ad blockers, reset mobile advertising identifiers, and maintain current software updates to reduce infection risk.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI