Citizen Lab said Discover-Tech’s targeted ads were the delivery path for AdFection, a zero-click spyware campaign that infected 45 Al Jazeera devices and reached other sensitive networks on iOS and Android. The group says this is the first detailed confirmation that mercenary spyware can ride through targeted advertising instead of a user click.
The ad looked ordinary, but when it loaded it quietly sent selected phones to Candiru infrastructure, so the impression itself became the trigger. That means the hostile traffic came from inside a trusted ad ecosystem, which is why standard phishing defenses and perimeter filters can miss it while a managed device still gets compromised.
For newsrooms, government agencies, and other environments that allow ad-supported mobile apps or browsing, the ad stack is no longer just a monetization layer. If those devices see the same ads, the compromise can land before anyone notices an interaction trail, and the exposure can sit in the mobile estate even when the network looks clean.
No click required: How the ad industry became a pipeline for mercenary spyware
Researchers have uncovered an advertising operation using real-time auctions to profile users and selectively deliver spyware, exposing serious gaps in vendor vetting.