Targeted ads delivered 0-click exploits to install mercenary malware
Summary
Researchers from the University of Toronto’s Citizen Lab discovered that hackers used targeted online ads to silently install malware on mobile devices without the users clicking anything. This "zero-click" spyware campaign, called AdFection, infected devices including those at Al Jazeera, affecting both iOS and Android phones through ads served by an Israeli company named Discover-Tech.Key Facts
- Hackers used ads to deliver spyware that works without any user interaction (“zero-click exploits”).
- The University of Toronto’s Citizen Lab confirmed the attack infected 45 devices at Al Jazeera in 2024 and 2025.
- The spyware targeted both iOS and Android devices and is hard to detect without special tools.
- Discover-Tech, an Israeli ad company, acted as a broker between advertisers and app or website publishers.
- Discover-Tech helped deliver spyware ads through major ad networks like Google, Yandex, and Beeswax.
- Over 4 billion ad bidding records from Discover-Tech were studied, showing ads appeared on 120,000 websites and 70,000 apps by mid-2026.
- Major platforms like Google and IAB Europe removed Discover-Tech after the report and blocked its ads.
- The spyware reached sensitive networks, including NATO and United Nations systems, showing risks to governments and large organizations.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
