Friday 16 October 2026
Morning Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Citizen Lab uncovers first known use of targeted ads to deliver zero-click mercenary spyware

Campaign dubbed ‘AdFection’ infected 45 devices at Al Jazeera, researchers say

By LineZotpaper
Published
Read Time2 min
Researchers at the University of Toronto’s Citizen Lab report that mercenary hackers have used targeted advertisements as a delivery mechanism for zero-click exploits, infecting at least 45 devices belonging to employees of international media organisation Al Jazeera with sophisticated spyware. The campaign, which the lab named AdFection, is believed to be the first confirmed instance of zero-click mercenary spyware being distributed through advertising networks.

In a report published Thursday, Citizen Lab researchers detailed how malicious ads laced with zero-click exploits were able to install spyware on iOS and Android devices without requiring any interaction from the target. The attacks work silently when a victim simply loads a website or opens an installed app, leaving no visible trace unless forensic hardware or software is used.

The researchers confirmed that the AdFection campaign infected 45 devices at Al Jazeera during 2024 and 2025. They described the discovery as a clear warning signal to news organisations worldwide that they may be actively targeted via this new threat vector.

“This investigation should … serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat,” the Citizen Lab report stated. The researchers added that the distribution of spyware through targeted ads represents a security risk not only for potential victims but also for states and civil society at large.

The report did not name the mercenary hacking group responsible or the specific ad networks exploited. Citizen Lab said the attacks were particularly pernicious because they required no action from the target beyond normal device use, making them extremely difficult to detect.

§

Analysis

Why This Matters

  • Targeted advertising networks are now a proven pipeline for zero-click spyware, dramatically expanding the attack surface for journalists, activists, and other high-risk individuals.
  • The low detection rate of these attacks means victims may never know their devices are compromised, allowing prolonged surveillance.
  • News organisations and civil society groups may need to reassess their digital security protocols to account for ad-delivered threats.

Background

Zero-click exploits are among the most dangerous types of malware because they require no user action, such as clicking a link or opening a file, to execute. Mercenary spyware vendors, often linked to governments, have historically relied on techniques like SMS-based exploits or malicious websites. Citizen Lab is a prominent academic research group that tracks digital espionage and has uncovered major spyware campaigns including those by NSO Group’s Pegasus. The use of advertising networks as a distribution channel is a novel escalation, as it leverages the scale and targeting precision of legitimate digital advertising infrastructure.

Key Perspectives

[Security researchers]: This is a significant escalation that undermines a common assumption that only direct messaging or phishing links carry zero-click threats. They warn that similar attacks may be used against other targets beyond Al Jazeera. [Digital advertising industry]: Ad networks and platforms may face pressure to audit their systems for malicious creatives, but the sophistication of the exploits makes detection challenging without deep technical investment. [Targeted organisations]: Newsrooms and human rights groups must now consider that simply visiting a website with a targeted ad could lead to infection, requiring more aggressive security measures like network-level blocking or device forensic monitoring.

What to Watch

  • Whether Citizen Lab or other researchers identify the specific ad networks or spyware vendor behind AdFection.
  • Any public response from advertising platforms like Google or Meta regarding steps to prevent similar abuse.
  • Reports of additional organisations or individuals affected by ad-delivered exploits, as the technique may be more widespread.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe