--- title: Targeted ads delivered 0-click exploits to install... description: Citizen Lab researchers at the University of Toronto uncovered a campaign dubbed AdFection in which mercenary hackers used targeted advertising to deliver... canonical: https://daily.dev/posts/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware-mtsqrv2xu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Targeted ads delivered 0-click exploits to install mercenary malware | daily.dev og:description: Citizen Lab researchers at the University of Toronto uncovered a campaign dubbed AdFection in which mercenary hackers used targeted advertising to deliver... og:url: https://daily.dev/posts/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware-mtsqrv2xu og:image: https://api.daily.dev/og/posts/MtSQRv2Xu.png og:image:alt: Targeted ads delivered 0-click exploits to install mercenary malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Targeted ads delivered 0-click exploits to install mercenary malware **[Ars Technica](https://daily.dev/sources/arstechnica)** · 2 min read · 0 upvotes · 0 comments ## Summary Citizen Lab researchers at the University of Toronto uncovered a campaign dubbed AdFection in which mercenary hackers used targeted advertising to deliver zero-click exploits that silently installed spyware on iOS and Android devices. The attacks required no user interaction and left no visible trace, confirmed to have infected 45 devices at Al Jazeera between 2024 and 2025. The ads were brokered by Discover-Tech, an Israeli ad company that Citizen Lab describes as acting as a bridge between legitimate ad networks and the mercenary spyware ecosystem, using bidding data on over 4 billion records across 70,000 apps and 120,000 websites to profile and target individuals, including journalists and newsroom staff. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the AdFection spyware campaign and how did it infect devices? AdFection is a mercenary spyware campaign identified by Citizen Lab that used zero-click exploits embedded in targeted mobile ads to infect iOS and Android devices without any user interaction, simply by loading a website or app containing the malicious ad. It was confirmed to have infected 45 devices at Al Jazeera in 2024 and 2025, and is considered the first confirmed case of spyware delivered through targeted advertising. _Security teams tracking mobile threat campaigns like this follow emerging spyware research on daily.dev._ ### What role does Discover-Tech play in the spyware ecosystem? Discover-Tech is an Israeli advertising company that Citizen Lab identified as acting as a broker bridging legitimate ad networks and mercenary spyware operators, which researchers describe as the company's primary purpose. It handled over 4 billion bidding records and displayed ads across more than 70,000 mobile apps and 120,000 websites between March and June 2026, using device IDs, location, and IP data to profile targets. _Teams evaluating adtech vendor risk can keep tabs on supply-chain spyware exposure via daily.dev._ ## Similar posts on daily.dev - [Targeted advertising is also targeting malware](https://daily.dev/posts/targeted-advertising-is-also-targeting-malware-gegtugxsv) · CSO Online · 0 upvotes · 0 comments - [Intellexa Leaks Reveal Zero-Days and Ads-Based Vector for Predator Spyware Delivery](https://daily.dev/posts/intellexa-leaks-reveal-zero-days-and-ads-based-vector-for-predator-spyware-delivery-arp9flquy) · The Hacker News · 0 upvotes · 0 comments - [Apple alerts exploit developer that his iPhone was targeted with government spyware](https://daily.dev/posts/apple-alerts-exploit-developer-that-his-iphone-was-targeted-with-government-spyware-vadlauxk2) · TechCrunch · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware-mtsqrv2xu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Targeted ads delivered 0-click exploits to install mercenary malware","url":"https://daily.dev/posts/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware-mtsqrv2xu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware-mtsqrv2xu"},"datePublished":"2026-10-15T21:04:36.680Z","dateModified":"2026-10-16T09:40:57.936Z","description":"Citizen Lab researchers at the University of Toronto uncovered a campaign dubbed AdFection in which mercenary hackers used targeted advertising to deliver...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ed769eedef2702d99ba03896c7e72f2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ed769eedef2702d99ba03896c7e72f2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Ars Technica","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ars Technica","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/80883e0e48a34b5ebcf93777016cb3fe","url":"https://daily.dev/sources/arstechnica"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware-mtsqrv2xu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ars Technica","item":"https://daily.dev/sources/arstechnica"},{"@type":"ListItem","position":3,"name":"Targeted ads delivered 0-click exploits to install mercenary malware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware-mtsqrv2xu#faq","mainEntity":[{"@type":"Question","name":"What is the AdFection spyware campaign and how did it infect devices?","acceptedAnswer":{"@type":"Answer","text":"AdFection is a mercenary spyware campaign identified by Citizen Lab that used zero-click exploits embedded in targeted mobile ads to infect iOS and Android devices without any user interaction, simply by loading a website or app containing the malicious ad. It was confirmed to have infected 45 devices at Al Jazeera in 2024 and 2025, and is considered the first confirmed case of spyware delivered through targeted advertising. Security teams tracking mobile threat campaigns like this follow emerging spyware research on daily.dev."}},{"@type":"Question","name":"What role does Discover-Tech play in the spyware ecosystem?","acceptedAnswer":{"@type":"Answer","text":"Discover-Tech is an Israeli advertising company that Citizen Lab identified as acting as a broker bridging legitimate ad networks and mercenary spyware operators, which researchers describe as the company's primary purpose. It handled over 4 billion bidding records and displayed ads across more than 70,000 mobile apps and 120,000 websites between March and June 2026, using device IDs, location, and IP data to profile targets. Teams evaluating adtech vendor risk can keep tabs on supply-chain spyware exposure via daily.dev."}}]} ```