Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app.
The finding, published Thursday by the University of Toronto’s Citizen Lab, said the incident is likely to be the first confirmation of zero-click mercenary spyware delivered through targeted ads. The attacks, which worked on iOS and Android devices, are particularly pernicious because they work without requiring any interaction from the target and are invisible unless users run special forensic hardware or software. Citizen Lab said it confirmed that AdFection, as it named the campaign, infected 45 devices at international media organization Al Jazeera in 2024 and 2025.
A clear warning signal
“This investigation should … serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat,” Citizen Lab researchers wrote. “This targeting may happen both in newsrooms and to individual journalists, editors, and other staff members.” Their report went on to say: “The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.”
The ads were provided by Discover-Tech, an Israeli company that brands itself as a legitimate advertising company, but Citizen Lab said it operates as a facilitator for multiple mercenary spyware partners. The company acts as a broker between parties that want to display their ads and publishers or app makers that seek revenue in return for showing them. In this capacity, Discover-Tech acts as a “bridge between ad vendors and the mercenary spyware ecosystem,” a role that appears to be “Discover-Tech’s primary purpose,” Citizen Lab said.
The brokering involves a bidding process in which advertisers offer a fee in exchange for their ads appearing on the devices of individuals in particular demographics. Using users’ unique mobile ID, location, IP address, and other breadcrumbs, the brokers are able to assemble detailed profiles of millions of people. Citizen Lab said it obtained more than 4 billion bidding records handled by Discover-Tech. They revealed that Discover-Tech ads were displayed in over 70,000 mobile apps and more than 120,000 websites between March and June 2026.
Among the major vendors that listed Discover-Tech as a “certified” or “verified” vendor were Google and the advertising industry association IAB Europe. The Israeli firm also used European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union. Discover-Tech has served ads through major networks such as Google, Yandex, and Beeswax.
Google and IAB Europe have since removed Discover-Tech from their ad vendor registries, and Google further terminated Discover-Tech’s access to its ad exchange platforms. Beeswax has removed Discover-Tech from its ad buying platform. Fellow ad platform Vungle (Liftoff) paused Discover-Tech’s access while conducting a review, and Eskimi blocked Discover-Tech’s accounts and domains.
Thursday’s report said that Discover-Tech ad impressions have appeared on government and national-security-linked networks throughout the world: NATO, United Nations networks, European lawmaking bodies, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden.
“Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” Citizen Lab said.
Messages sent to Discover-Tech and Candiru went unanswered.
The research lab said that the mercenary malware installed through AdFection was developed and distributed by Candiru (rebranded as “Integrity Labs”). Under the arrangement with Discover-Tech, targets with specific profiles of interest to the Candiru customers received ads that carried JavaScript or other code that connected to Candiru’s control servers. In response, those servers delivered an exploit that served the zero-click payload when the ad appeared on an individual’s device.
The research doesn’t describe the vulnerabilities exploited in the zero-click attacks or the final malware that was installed in them. It’s likely they were zero-days that have been fixed after Citizen Lab discovered the campaign. Citizen Lab didn’t immediately respond to questions.
Citizen Lab called on advertisers and government officials to take concrete action to proactively prevent campaigns like AdFection. Beyond that, users can reduce the risk of being infected by installing ad blockers, resetting mobile advertising ID in iOS and Android settings (it’s unclear why the researchers didn’t advise turning off personalized ads altogether), and installing ad-blocking software on home or office networks. As always, installing updates in a timely manner is also a must.
