Targeted ads delivered 0-click exploits to install mercenary malware
ars ·
Researchers from the University of Toronto’s Citizen Lab have identified a new campaign named AdFection, which used targeted advertisements to deliver zero-click exploits installing mercenary spyware on mobile devices. This incident marks the first confirmed case of such sophisticated malware being distributed through the online advertising ecosystem, affecting both iOS and Android platforms without any user interaction. The attack infected 45 devices belonging to Al Jazeera staff between 2024 and 2025, highlighting a severe threat to journalists and media organizations globally. The malicious ads were facilitated by Discover-Tech, an Israeli company that acted as a broker connecting advertisers with mercenary spyware developers like Candiru. By leveraging detailed user profiles and major ad networks, the campaign reached over 70,000 apps and 120,000 websites, including those linked to government and security entities. Following the exposure, major industry players such as Google, IAB Europe, and Beeswax removed Discover-Tech from their vendor registries and platforms. The report underscores significant structural flaws in the digital advertising system that allowed this privacy invasion and security breach to occur. Experts recommend using ad blockers and keeping software updated to mitigate similar risks in the future.
ars