Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app. The finding, published Thursday by the University of Toronto’s Citizen Lab, said the incident is likely to be the first confirmation of zero-click mercenary spyware delivered through targeted ads. The attacks, which worked on iOS and Android devices, are particularly pernicious because they work without requiring any interaction from the target and are invisible unless users run special forensic hardware or software.
Citizen Lab said it confirmed that AdFection, as it named the campaign, infected 45 devices at international media organization Al Jazeera in 2024 and 2025. The company acts as a broker between parties that want to display their ads and publishers or app makers that seek revenue in return for showing them. In this capacity, Discover-Tech acts as a “bridge between ad vendors and the mercenary spyware ecosystem,” a role that appears to be “Discover-Tech’s primary purpose,” Citizen Lab said.
The brokering involves a bidding process in which advertisers offer a fee in exchange for their ads appearing on the devices of individuals in particular demographics. Using users’ unique mobile ID, location, IP address, and other breadcrumbs, the brokers are able to assemble detailed profiles of millions of people. Citizen Lab said it obtained more than 4 billion bidding records handled by Discover-Tech.
They revealed that Discover-Tech ads were displayed in over 70,000 mobile apps and more than 120,000 websites between March and June 2026.
Extract — continue reading at the source.
