Citizen Lab: AdFection Campaign Used Targeted Ads for Spyware

Mercenary Spyware Reaches Mobile Devices Through Automated Ad Bidding Networks

Targeted digital advertisements delivered zero-click exploits that silently installed sophisticated spyware onto iOS and Android devices without any interaction from users. The discovery, published by the University of Toronto’s Citizen Lab, marks what researchers describe as the first confirmation of zero-click mercenary spyware delivered through targeted ads.

The Tech TL;DR:

• The AdFection campaign deployed zero-click exploits via targeted ads that required no user interaction beyond loading a website or opening an app.
• Citizen Lab confirmed the campaign infected 45 devices belonging to staff at international media organization Al Jazeera across 2024 and 2025.
• Researchers identified an Israeli advertising firm, Discover-Tech, as the bridge that processed over 4 billion bidding records to profile specific targets.

Uncovering the AdFection Campaign at Al Jazeera

The campaign, tracked under the codename AdFection, exploited programmatic advertising infrastructure to deliver malicious payloads. According to Citizen Lab researchers, the infection vector functioned entirely in the background when a target loaded an ordinary website or opened an installed mobile application. Victims did not need to click a link or download a file for the exploit to execute.

Between 2024 and 2025, the campaign infected 45 distinct devices used by personnel at international media organization Al Jazeera. The forensic investigation revealed that the spyware left no visible trace on infected hardware, remaining hidden unless operators deployed specialized forensic software or hardware analysis tools.

How Discover-Tech Brokered Bidding Data for Surveillance

The mechanics of the distribution relied on automated ad exchange networks. The ads were brokered by Discover-Tech, an Israeli ad company that functioned as a bridge between legitimate advertising networks and the mercenary spyware ecosystem. Between March and June 2026, the firm handled more than 4 billion bidding records and served ads across over 70,000 mobile applications and 120,000 websites.

By using device identifiers, geolocation data, and IP addresses harvested through real-time bidding streams, the operation profiled individual journalists and newsroom staff. Citizen Lab warned that the distribution method poses a security risk not only to targeted media personnel but to civil society and state institutions more broadly.

The Open Question Facing Enterprise Security Teams

Despite the detailed attribution linking the exploit delivery to automated bidding platforms, the specific identity of the ultimate buyer behind the AdFection spyware deployment remains unverified in public findings. Security analysts tracking mobile threat vectors have yet to determine the full scope of individuals targeted outside of the confirmed Al Jazeera infections, leaving organizations to evaluate how programmatic ad-delivery networks can be secured against unauthorized surveillance payloads.

Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.