AdFection campaign installs zero-click spyware on Al Jazeera devices via targeted ads

Mercenary operators gained persistent access to 45 devices at Al Jazeera by exploiting a gap in digital advertising infrastructure, according to a report by the University of Toronto’s Citizen Lab. The attackers needed only for the target to load a website or open an app containing a malicious ad. This method bypassed traditional defenses because it required zero interaction from the victim, allowing sophisticated surveillance software to install itself silently.

In plain English

The threat relies on the normal way mobile apps and websites display advertisements. When a user opens an app or visits a site, the platform requests an ad to show. In this case, the ad itself contained hidden code that attacked the device’s operating system. Because the exploit was zero-click, the user did not need to tap the ad or visit a separate link. The infection happened automatically in the background, making it invisible to anyone who does not use specialized forensic tools to inspect their device.

The background

Citizen Lab identified the campaign as AdFection, marking what researchers believe is the first confirmed instance of mercenary spyware delivered via targeted ads. The ads were facilitated by Discover-Tech, an Israeli company that Citizen Lab describes as a bridge between ad vendors and the spyware ecosystem. Discover-Tech uses bidding processes to place ads on specific devices based on user profiles built from mobile IDs, location data, and IP addresses. The company served these ads across more than 70,000 apps and 120,000 websites between March and June 2026.

What changes now

News organizations face a new vector for targeted surveillance that extends beyond direct messaging or email phishing. Citizen Lab warned that this targeting affects not only individual journalists but also newsrooms broadly. The finding suggests that the advertising supply chain itself can be weaponized to deliver high-value espionage tools. Security teams must now consider that legitimate ad networks and brokers may inadvertently or intentionally facilitate the delivery of zero-click exploits to high-profile targets.

What made it possible

This incident highlights the risk of trusting third-party content delivery systems that operate with high privileges on user devices. Teams usually monitor for malicious links or attachments, but this technique bypasses those checks by embedding exploits in standard ad requests. Check whether your organization’s mobile security policy accounts for untrusted code execution within advertising frameworks. The weakness lies in the assumption that ad content is benign, allowing attackers to leverage the trust relationship between apps and ad servers to achieve initial access without user consent.

Background: Supply chain attacks

Small businesses face supply chain attacks because attackers target weaker vendors to reach you. Protect your network by enforcing least privilege, verifying software signatures, and demanding strict access logs from your IT provider. Isolate critical data and assume third-party tools can be compromised at any time.

Read the full guide: Supply Chain Attack Risks and Protection for Small Business

What to do and how to stay safe: AdFection

• Audit mobile applications and websites for ad frameworks that execute code with elevated privileges or access to sensitive system resources.
• Monitor network traffic for unusual connections to known advertising brokers or domains associated with mercenary spyware campaigns.
• Implement strict device configuration policies that limit the ability of apps to run background processes or access hardware sensors without explicit user approval.
• Review forensic capabilities to ensure detection methods can identify zero-click infections that leave minimal traces in standard system logs.

Step-by-step guide: Ransomware Explained: How File Locking Works and What to Do

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which devices were affected by the AdFection campaign?

The campaign targeted iOS and Android devices, specifically infecting 45 devices used by Al Jazeera staff.

Who facilitated the delivery of the spyware?

Discover-Tech, an Israeli advertising broker, facilitated the delivery by serving ads containing the exploits to targeted devices.

Did the victims need to click on the ads to be infected?

No, the exploits were zero-click, meaning they installed the malware automatically when the ad loaded, without any user interaction.