Targeted Ads Exploit Zero-Click Vulnerabilities to Deploy Mercenary Spyware

Image: Ars Technica · Source

Citizen Lab reveals that Israeli firm Discover-Tech facilitated targeted ads carrying zero-click exploits that installed Candiru spyware on iOS and Android devices at Al Jazeera and beyond.

A detailed investigation by the University of Toronto’s Citizen Lab has uncovered a sophisticated spyware campaign leveraging targeted advertising to deliver zero-click exploits on mobile devices. The campaign, dubbed AdFection, reportedly infected at least 45 devices belonging to personnel at Al Jazeera during 2024 and 2025, marking the first confirmed case of mercenary spyware deployment via targeted ads.

Citizen Lab’s report indicates that the spyware was distributed through ads provided by Discover-Tech, an Israeli company operating as an intermediary between advertisers seeking specific user profiles and publishers or app developers. This arrangement allowed Discover-Tech to serve malicious ads embedding zero-click attack code, infecting iOS and Android devices when users merely loaded a website or app without any direct interaction.

Through extensive analysis of over 4 billion bid records managed by Discover-Tech, the research revealed the company’s ads appeared across more than 70,000 mobile apps and 120,000 websites globally between March and June 2026. The campaign targeted users by leveraging detailed profiles constructed from unique mobile IDs, geolocation data, IP addresses, and other identifiers. Notably, Discover-Tech also exploited GDPR mechanisms to focus attacks within the European Union.

Further raising alarms, Discover-Tech’s ad impressions were detected on networks linked to government, national security, and critical infrastructure entities, including NATO, the United Nations, European legislative bodies, and various armed forces. This widespread exposure emphasizes intrinsic vulnerabilities within the online advertising ecosystem, which failed to identify or block the misuse.

Upon disclosure, major industry players such as Google, IAB Europe, Beeswax, Vungle, and Eskimi acted swiftly to remove or suspend Discover-Tech from their platforms, limiting the firm’s ad distribution capabilities.

Citizen Lab attributes the underlying spyware to Candiru (also known as Integrity Labs), a mercenary hacking firm. Candiru supplied the zero-click exploits and spyware payloads delivered through Discover-Tech’s ad infrastructure.

The investigation stops short of detailing the exact vulnerabilities exploited but suggests these were likely zero-day attacks subsequently patched following the campaign’s exposure. Attempts to elicit comment from Discover-Tech and Candiru remained unanswered.

In response to these findings, Citizen Lab urges advertisers and government agencies to implement robust safeguards against such threats. They recommend individual users employ ad blockers, regularly reset mobile advertising identifiers, and ensure timely software updates to reduce infection risks. The research underscores a critical need for systemic reforms within digital advertising to prevent mercenary spyware campaigns from proliferating through trusted commercial channels.