Cybersecurity

Targeted Ads Delivered Zero-Click Exploits for Spyware

A newly detailed campaign dubbed AdFection demonstrates how programmatic advertising infrastructure can be weaponized to deliver mercenary malware via zero-click exploits.

Radwan AbdulhadiEditor and technology writer

Published: October 18, 2026 · Updated: October 18, 2026 · 4 min read

Targeted Ads Delivered Zero-Click Exploits for Spyware — Image: Ars Technica

The AdFection Campaign and Zero-Click Exploits

According to a report published Thursday, mercenary hackers successfully laced online advertisements with zero-click exploits capable of installing sophisticated malware onto targeted devices. Users did not need to click anything; simply loading a website or opening an installed application was enough to trigger the exploit.

The findings were detailed in an investigation by the University of Toronto’s <a href="https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/">Citizen Lab</a>, which stated that the incident represents likely the first confirmation of zero-click mercenary spyware distributed through targeted ads. The attacks affected both iOS and Android devices, operating invisibly without requiring any interaction from the target, and could only be detected using special forensic software or hardware.

Citizen Lab confirmed that the campaign, which it named AdFection, successfully infected 45 devices belonging to staff at the international media organization Al Jazeera throughout 2024 and 2025. Researchers warned that the distribution of spyware via targeted ads poses a serious structural risk not only to potential victims in newsrooms, but also to civil society and states at large.

The Role of Discover-Tech and the Advertising Ecosystem

The ads carrying the malicious payloads were provided by Discover-Tech, an Israeli firm that presented itself as a legitimate advertising company. However, the Citizen Lab investigation revealed that the firm operates primarily as a bridge and facilitator connecting ad vendors with the mercenary spyware ecosystem.

Discover-Tech acted as a broker in automated bidding processes, using unique mobile IDs, locations, IP addresses, and other data points to build detailed profiles of millions of individuals. Data obtained by researchers—including more than 4 billion bidding records handled by Discover-Tech—revealed that its ads appeared in over 70,000 mobile apps and more than 120,000 websites between March and June 2026.

The Israeli firm managed to list itself as a certified or verified vendor with major entities such as Google and the advertising industry association IAB Europe. Furthermore, Discover-Tech utilized European General Data Protection Regulation consent frameworks to target users within the European Union, serving ads through major networks like Google, Yandex, and Beeswax.

Global Reach and Government Network Exposure

The scope of the AdFection campaign extended far beyond media organizations. Discover-Tech ad impressions were reportedly detected on government and national-security-linked networks globally, including NATO infrastructure, United Nations networks, European lawmaking bodies, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden.

Citizen Lab noted that this mass abuse, privacy invasion, and facilitation of mercenary attacks highlights structural vulnerabilities within the online advertising system, which failed to detect or prevent the abuse documented in the report.

Connection to Candiru and Malware Distribution

The mercenary malware distributed through the AdFection campaign was developed and distributed by Candiru, which has rebranded as Integrity Labs. Under this operational arrangement, targets possessing specific profiles of interest received ads embedded with JavaScript or other code connecting to Candiru’s control servers.

In response, those servers delivered an exploit that executed the zero-click payload when the advertisement appeared on the target's device. While the exact vulnerabilities and final malware payloads were not fully detailed in the research, experts believe they involved zero-day vulnerabilities that were likely patched after Citizen Lab uncovered the operation.

Neither Discover-Tech nor Candiru responded to requests for comment regarding the findings.

Industry Response and Mitigation Advice

In response to the disclosures, major technology platforms and advertising networks took swift action. Google removed Discover-Tech from its ad vendor registries, terminated its access to ad exchange platforms, and IAB Europe similarly removed the firm. Beeswax removed Discover-Tech from its ad buying platform, Vungle paused its access for a review, and Eskimi blocked the company's accounts and domains.

Citizen Lab has urged advertisers, technology companies, and government officials to implement concrete measures to proactively block campaigns like AdFection. For individual users, researchers recommended installing ad blockers, resetting mobile advertising identifiers in operating system settings, and deploying ad-blocking software on home or office networks, alongside maintaining timely software updates.