iOS and Android Ad Frameworks Exploited for Zero-Click Mercenary Spyware Delivery
Citizen Lab confirms the AdFection campaign used targeted ads to install spyware on mobile devices without user interaction, exposing newsrooms to silent compromise.
Key points
- The AdFection campaign infected 45 Al Jazeera devices in 2024 and 2025 via zero-click exploits embedded in ads.
- Discover-Tech acted as a broker, delivering malicious ads to over 70,000 apps and 120,000 websites between March and June 2026.
- The attack required no user interaction, making it invisible without specialised forensic hardware or software analysis.
University of Toronto’s Citizen Lab published a report Thursday confirming that mercenary hackers delivered spyware through targeted advertisements on iOS and Android devices. The campaign, named AdFection, compromised staff at Al Jazeera by exploiting mobile operating systems without requiring any action from the victims.
What happened
Citizen Lab identified that the AdFection campaign installed sophisticated malware on devices simply by loading a website or opening an installed application. The researchers confirmed infections on 45 devices belonging to international media organisation Al Jazeera during 2024 and 2025. The exploits were embedded within advertisements provided by Discover-Tech, an Israeli firm that Citizen Lab describes as a facilitator for mercenary spyware partners rather than a legitimate advertising entity.
Discover-Tech operated as a broker connecting ad vendors with publishers and app makers seeking revenue. According to Citizen Lab, the company’s primary purpose appears to be bridging ad vendors with the mercenary spyware ecosystem. Advertisers paid fees to display their ads on devices of specific demographics, using unique mobile IDs, location data, IP addresses and other digital breadcrumbs to build detailed profiles of millions of people.
Why it matters
Citizen Lab obtained more than 4 billion bidding records handled by Discover-Tech, revealing the scale of the operation. These records showed that ads from the broker were displayed in over 70,000 mobile applications and more than 120,000 websites between March and June 2026. The researchers warned that news organisations worldwide may be actively targeted via this method, posing risks to journalists, editors and other staff members.
The distribution of spyware via targeted ads represents a security risk for potential victims, states and civil society at large. Because the attacks work without requiring interaction from the target, they remain invisible unless users run special forensic hardware or software. This lack of user interaction makes traditional detection methods based on click behaviour or explicit consent ineffective against such campaigns.
Next steps
- Review mobile advertising SDKs integrated into corporate applications and websites for known vulnerabilities associated with zero-click exploits.
- Audit network logs for unusual outbound connections from mobile devices that do not correlate with standard application usage patterns.
- Implement strict device attestation processes for high-value targets, such as journalists and senior editors, to verify device integrity.
- Collaborate with industry groups to share indicators of compromise related to ad-brokered malware campaigns and targeted advertising vectors.
Detection notes
Teams usually monitor for anomalous network behaviour from mobile devices, such as unexpected data exfiltration or connections to unknown command-and-control servers. Check whether endpoint detection and response solutions flag suspicious process injections or memory modifications that occur without user interaction. Look for unusual advertising SDK activity or unexpected permissions requests from installed applications. Containment moves often involve isolating affected devices from the network to prevent further data leakage and conducting forensic imaging to analyse the malware’s persistence mechanisms.
What to do and how to stay safe: iOS
- Audit all third-party advertising SDKs and libraries used in corporate mobile applications and web properties for known security flaws.
- Monitor network traffic for unusual outbound connections from mobile devices that may indicate command-and-control communication.
- Implement strict device integrity checks for high-value personnel, such as journalists and senior staff, to detect unauthorised software installations.
- Stay informed about emerging threats related to ad-brokered malware and update security protocols accordingly.
Step-by-step guide: Infostealers Explained: How Data Theft Happens and How to Stop It
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the AdFection campaign infect devices without user interaction?
The campaign used zero-click exploits embedded in targeted advertisements that installed malware when a website loaded or an app opened, requiring no action from the victim.
Which organisation was confirmed to be affected by the AdFection campaign?
Citizen Lab confirmed that 45 devices at international media organisation Al Jazeera were infected in 2024 and 2025.
What role did Discover-Tech play in the AdFection campaign?
Discover-Tech acted as a broker, connecting ad vendors with publishers and app makers, and facilitated the delivery of mercenary spyware through targeted advertisements.
