The University of Toronto’s Citizen Lab published findings Thursday documenting a sophisticated campaign it named AdFection, which used targeted advertisements to deliver zero-click malware to mobile devices. The attacks functioned on both iOS and Android platforms and required no user interaction to succeed, remaining invisible without specialized forensic tools. The campaign infected approximately 45 devices belonging to staff at international media organization Al Jazeera, and researchers characterized the discovery as likely the first confirmed instance of mercenary spyware distributed through this advertising delivery method.
The ads were facilitated by Discover-Tech, an Israeli advertising company that functions as a broker between advertisers and publishers. While presenting itself as a legitimate ad platform, Citizen Lab determined that Discover-Tech primarily serves as a liaison between ad vendors and the mercenary spyware sector. The brokering process involves targeted bidding where advertisers pay to display content to individuals matching specific demographic profiles. Between March and June 2026, Discover-Tech ads appeared across more than 70,000 mobile applications and 120,000 websites. Major platforms including Google and the industry association IAB Europe had certified Discover-Tech as a vendor prior to the discovery.
Citizen Lab obtained over 4 billion bidding records from Discover-Tech and identified ad impressions on networks linked to government and national security operations, including NATO, the United Nations, European legislative bodies, and armed forces in Norway and Sweden. The malware deployed through the campaign was developed by Candiru, a firm that recently rebranded as Integrity Labs. The mechanism involved JavaScript code embedded in ads that connected to Candiru’s servers, triggering the delivery of exploit code when advertisements loaded on target devices.
Following the revelations, multiple advertising platforms took action to remove Discover-Tech from their networks. Google terminated the company’s access to its ad exchange platforms, while Beeswax removed it from its ad buying platform. Vungle and Eskimi also suspended or blocked Discover-Tech’s operations pending review. Citizen Lab stated that the incident demonstrates structural vulnerabilities in the online advertising ecosystem and recommended users employ ad blockers, adjust mobile advertising settings, and maintain current software updates to reduce infection risk.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI