Targeted ads offer 0-click exploits to install mercenary malware

This incident is possibly the first confirmation of spyware for mercenaries served by targeted advertising.

Hackers for hire advertise with zero-click exploits that install sophisticated malware on target devices when they do nothing but load a website or open an installed app, researchers say.

The finding, published Thursday by the University of Toronto's Citizen Lab, said the incident is likely the first confirmation of zero-click mercenary spyware delivered through targeted advertising. Attacks that work on iOS and Android devices are particularly dangerous because they work without requiring interaction with the target and are invisible unless users run special forensics hardware or software. Citizen Lab said it confirmed that AdFection, as it dubbed the campaign, infected 45 machines at the Al Jazeera International Media Organization in 2024 and 2025.

"This research should serve as a clear warning signal to news organizations around the world that they may be actively targeted by this new threat," Citizen Lab researchers wrote. "This targeting may occur both in newsrooms and for journalists, editors and other staff." "The distribution of spyware through targeted advertising represents a security risk not only to potential victims but to states and civil society at large," their report continued.

The ads are served by Discover-Tech, an Israeli company that bills itself as a legitimate advertising company, but Citizen Lab said it acts as a facilitator for several mercenary spyware partners. The company acts as an intermediary between the parties who want to display their ads and the publishers or app creators who seek revenue in return for displaying them. In this capacity, Citizen Lab said, Discover-Tech serves as "a bridge between ad vendors and the mercenary spyware ecosystem," a role that appears to be Discover-Tech's "primary purpose."

Brokerage involves a bidding process where advertisers offer a fee in exchange for their ads to be displayed on the devices of people in a certain demographic. Brokers can gather detailed profiles of millions of people using unique cell phone IDs, locations, IP addresses, and more. Citizen Lab said it obtained more than 4 billion bid records managed by Discover-Tech. They revealed that Discover-Tech ads were displayed on more than 70,000 mobile apps and more than 120,000 websites between March and June 2026.

Among the major vendors that list Discover-Tech as an "Approved" or "Approved" vendor are Google and the advertising industry association IAB Europe. The Israeli company also used the consent frameworks of the European General Data Protection Regulation (GDPR) to target users in the EU. Discover-Tech has served ads through major networks such as Google, Yandex and Beeswax.

Google and IAB Europe have since removed Discover-Tech from their ad vendor listings, and Google has further cut off Discover-Tech's access to its ad exchange platforms. Beeswax removed Discover-Tech from its ad buying platform. Vungle's partner advertising platform (Liftoff) suspended Discover-Tech's access while it conducted a review, and Eskimi blocked Discover-Tech's accounts and domains.

Discover-Tech ads appeared on government and national security-related networks around the world: NATO, United Nations networks, European legislative bodies, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden, Thursday's report said.

"Discover-Tech's mass abuse, invasion of privacy, and facilitation of mercenary spyware attacks demonstrate structural flaws in the online advertising system that failed to detect or prevent the abuse documented in this report," Citizen Lab said.

The research lab said the mercenary malware installed via AdFection was developed and distributed by Candiru (branded as "Integrity Labs"). Pursuant to the agreement with Discover-Tech, targets with specific profiles of interest to Candiru customers received advertisements that contained JavaScript or other code that connected to Candiru's control servers. In response, those servers delivered an exploit that delivered a zero click load when the ad appeared on a person's device.

This research does not describe the vulnerabilities exploited in zero-click attacks or the ultimate malware. It is installed in them. Most likely they were zero days that were removed after the Citizen Lab campaign was discovered. Citizen Lab did not immediately respond to questions.

Messages sent to Discover-Tech and Candiru went unanswered.

Citizen Lab called on advertisers and government officials to take concrete action to actively prevent campaigns like AdFection. Beyond that, users can reduce their risk by installing ad blockers, resetting the mobile ad ID in iOS and Android settings (it's unclear why the researchers didn't recommend turning off personalized ads altogether), and installing ad blocking software on home or office networks. As always, timely installation of updates is also essential.

Dan Goodin is senior security editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In her spare time she enjoys gardening, cooking and following the independent music scene. Don is based in San Francisco. Follow him here on Mastodon and here on Bluesky. Contact him on the signal at DanArs.82.