Citizen Lab: Mercenary Spyware Delivered via Targeted Ads on iOS and Android
Researchers say the incident is likely the first confirmation of zero-click spyware delivered through targeted ads, affecting Al Jazeera staff.
Key points
- Citizen Lab confirmed the AdFection campaign infected 45 Al Jazeera devices in 2024 and 2025 using zero-click exploits.
- The attacks targeted both iOS and Android devices, requiring no user interaction to install the sophisticated spyware.
- Discover-Tech, an Israeli ad broker, facilitated the distribution by linking mercenary spyware vendors with publishers and apps.
University of Toronto’s Citizen Lab published a report on Thursday stating that mercenary hackers delivered zero-click spyware through targeted digital advertisements. The findings indicate this incident is likely the first confirmation of such spyware being distributed via this specific ad-based mechanism, affecting devices without any user interaction.
The research team named the campaign AdFection and verified that it successfully infected 45 devices belonging to staff at the international media organization Al Jazeera during 2024 and 2025. According to Citizen Lab, the exploits worked on both iOS and Android operating systems. The malware installation occurred simply when targets loaded a website or opened an installed app, making the attacks invisible unless special forensic tools are used.
Context and Background
Citizen Lab identified Discover-Tech, an Israeli company, as the primary facilitator for these attacks. While Discover-Tech brands itself as a legitimate advertising firm, the researchers stated it operates as a bridge between ad vendors and the mercenary spyware ecosystem. The company brokers deals between parties seeking to display ads and publishers or app makers looking for revenue, a role Citizen Lab described as Discover-Tech’s primary purpose.
The brokering process involves a bidding system where advertisers pay fees to target specific demographics. Brokers use unique mobile IDs, location data, IP addresses, and other digital breadcrumbs to build detailed profiles of millions of users. Citizen Lab obtained more than 4 billion bidding records handled by Discover-Tech, revealing the scale of data collection and ad placement involved in these operations.
Who Is Affected
The report warns that news organizations worldwide face active targeting through this new threat vector. Citizen Lab researchers noted that attacks may occur in newsrooms as well as against individual journalists, editors, and other staff members. The distribution of spyware via targeted ads poses a security risk not only for potential victims but also for states and civil society at large, according to the University of Toronto group.
Data from the 4 billion bidding records showed that Discover-Tech ads were displayed in over 70,000 mobile apps and more than 120,000 websites between March and June 2026. This widespread distribution highlights the potential reach of the mercenary spyware ecosystem and the difficulty in isolating specific high-value targets from the broader audience exposed to these advertisements.
What should you do?
Security professionals should monitor for unusual network traffic that could indicate zero-click exploit activity, even if users report no issues. Organizations should audit their mobile application lists to identify any apps that may host ad networks associated with known mercenary brokers. Reviewing server logs for connections to domains linked to Discover-Tech or similar intermediaries can help detect early signs of compromise.
What to do and how to stay safe: Citizen Lab
- Audit mobile devices for unknown applications or adware that may serve as delivery vectors for targeted exploits.
- Monitor network traffic for connections to domains associated with mercenary spyware brokers like Discover-Tech.
- Implement strict mobile device management policies to restrict the installation of apps from unverified sources.
- Use specialized forensic tools to detect zero-click malware that does not require user interaction to activate.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is the name given by Citizen Lab to a campaign that used targeted ads to deliver zero-click mercenary spyware to iOS and Android devices.
How many devices were infected?
Citizen Lab confirmed that 45 devices at Al Jazeera were infected by the AdFection campaign in 2024 and 2025.
What is the role of Discover-Tech?
Discover-Tech acts as a broker connecting mercenary spyware vendors with publishers and app makers, facilitating the delivery of malicious ads.
