Zero-click mercenary spyware campaign delivered via targeted ads, Citizen Lab reports

Researchers at the University of Toronto’s Citizen Lab say they have identified AdFection, a zero‑click spyware campaign delivered through targeted advertisements that required no user interaction to trigger infection on iOS and Android devices. The campaign compromised 45 devices at the international media organization Al Jazeera during 2024 and 2025, according to the lab’s report.

Citizen Lab describes AdFection as likely the first confirmed case of mercenary spyware delivered via targeted ads. The malicious ads were served through Discover‑Tech, an Israeli ad‑broker that Citizen Lab characterizes as a bridge between advertisers and the mercenary spyware ecosystem. The broker assembled detailed profiles of millions of people using mobile IDs, location, IP addresses, and other signals, then targeted specific demographics through a bidding process.

Discover‑Tech’s ads were displayed across more than 70,000 mobile apps and 120,000 websites between March and June 2026, with major vendors including Google and IAB Europe previously listing Discover‑Tech as a certified or verified vendor. After the report’s findings, Google and IAB Europe removed Discover‑Tech from their ad vendor registries, and Google terminated its access to ad exchange platforms; Beeswax removed Discover‑Tech from its platform, Vungle paused its access pending review, and Eskimi blocked its accounts and domains.

The malware delivered via AdFection is linked to Candiru, which has rebranded as Integrity Labs. Citizen Lab states that targets matching specific profiles received ads carrying JavaScript or other code that connected to Candiru’s control servers, which then delivered a zero‑click exploit when the ad appeared on a device. Citizen Lab did not detail the exploited vulnerabilities or the final payload, noting they were likely zero‑days subsequently patched after discovery.

The report warns that the campaign poses risks not only to targeted individuals but also to states and civil society, and it highlights structural flaws in the online advertising system that failed to detect or prevent the abuse. Citizen Lab calls for concrete action from advertisers and officials to prevent similar campaigns, while recommending mitigation steps such as installing ad blockers, resetting mobile advertising IDs, and applying timely software updates.