RESEARCHERS from the University of Toronto’s Citizen Lab say they have found mercenary spyware delivered via targeted ads that exploit devices with zero user interaction. Dubbed AdFection, the campaign operated on both iOS and Android and could install sophisticated malware simply when a user loaded a page or app, without tapping anything.
Citizen Lab’s report, published on 15 October 2026, asserts this is the first confirmed instance of zero-click mercenary spyware distributed through targeted ads, with 45 devices at the international media organisation Al Jazeera infected in 2024 and 2025.
The investigation traces the operation to Discover-Tech, an Israeli firm acting as a broker between ad vendors and mercenary spyware partners. The ads were served to highly targeted profiles using unique mobile IDs, location data, IP addresses, and other identifiers, and appeared across more than 70,000 mobile apps and 120,000 websites between March and June 2026.
The spyware was developed and distributed by Candiru, now marketed as Integrity Labs, with the ads directing devices to Candiru’s control servers where a zero-day or similar vulnerability delivered the malicious payload. Major ad platforms including Google, YAB Europe, Beeswax, Vungle (Liftoff), and Eskimi have since stepped back or removed Discover-Tech.
The report urges advertisers and policymakers to take action to prevent such campaigns, and suggests users mitigate risk with ad blockers, resetting mobile advertising IDs, and applying timely updates.