Targeted ads delivered 0-click exploits to install mercenary malware
Citizen Lab says a campaign it calls AdFection used targeted online adverts to install mercenary spyware on iOS and Android devices, without victims needing to click or take any other action. The finding is described as likely the first confirmed case of mercenary spyware delivered through targeted ads, raising concerns for journalists and others whose devices may be targeted without their knowledge.
The lab confirmed infections on 45 devices at Al Jazeera in 2024 and 2025, and examined more than 4 billion advertising-bidding records handled by Israeli firm Discover-Tech. Those records showed its ads appeared in over 70,000 apps and 120,000 websites between March and June 2026; the malware was attributed to Candiru, which has rebranded as Integrity Labs. Google, IAB Europe and several advertising platforms have since removed, blocked or suspended Discover-Tech, whose ads had also appeared on networks linked to governments and critical infrastructure.
- Targeted adverts installed spyware without users clicking.
- Citizen Lab confirmed 45 infections at Al Jazeera.
- Ad platforms have removed or suspended Discover-Tech.
New here? Start with this
Mercenary spyware is surveillance software sold by private companies to governments or other clients. It can give an operator access to information on a phone, such as messages, contacts or location, and is often aimed at specific people rather than spread widely.
Online advertising involves companies bidding to show adverts in apps and on websites, using systems that can select audiences and places to display them. Security researchers have previously documented spyware infections through malicious links or messages; advertising raises a different concern because adverts can reach a device during ordinary browsing.
Journalists, human rights workers and people involved in public affairs may be targeted because of the information they hold or their contacts. Establishing how spyware is delivered, and who is behind it, can help technology companies and regulators assess risks across the advertising networks used by many people.