- Published on
Targeted ads delivered 0-click exploits to install mercenary malware
- Authors
- Name
- DeepHorus
Citizen Lab reported Thursday that mercenary hackers used targeted ads to deliver zero-click exploits installing malware on iOS and Android devices. The campaign, named AdFection, infected 45 devices at Al Jazeera in 2024 and 2025. The attacks needed no user interaction and stayed invisible without special forensic tools.
The finding is likely the first confirmation of zero-click mercenary spyware delivered through targeted ads. Such attacks are pernicious because they run when a target merely loads a website or opens an app. This stealth makes detection difficult for journalists and newsroom staff.
The ads came from Discover-Tech, an Israeli company presenting itself as a legitimate advertising business. Citizen Lab said it instead facilitates multiple mercenary spyware partners. It brokers between advertisers and publishers or app makers, acting as a “bridge between ad vendors and the mercenary spyware ecosystem.”
The brokering uses a bidding process where advertisers pay to target devices by demographics. Brokers use mobile IDs, locations, IP addresses, and other data to profile millions. Citizen Lab obtained more than 4 billion bidding records handled by Discover-Tech.
Those records showed Discover-Tech ads appeared in over 70,000 mobile apps and more than 120,000 websites between March and June 2026. This scale suggests the ad infrastructure reached a vast audience while allegedly enabling spyware distribution. Citizen Lab called brokering Discover-Tech’s apparent primary purpose.
Citizen Lab warned the investigation is a clear warning signal to news organizations worldwide. It said targeting may occur in newsrooms and against individual journalists, editors, and other staff. Spyware distribution via targeted ads risks not only victims but also states and civil society, highlighting a growing threat to press freedom and digital security.
