Ad campaign delivered spyware via zero-click exploits
Researchers report mercenary hackers used ads for zero-click exploits, installing spyware without user interaction.
Researchers at the University of Toronto's Citizen Lab have confirmed that mercenary hackers delivered sophisticated spyware through targeted advertisements. These "zero-click" vulnerabilities activate when a target loads a webpage or opens an app, requiring no user interaction.
The AdFection campaign successfully infected 45 devices at the international media organization Al Jazeera during 2024 and 2025. The attacks targeted both iOS and Android devices and are particularly dangerous due to their stealthy operation. Only specialized forensic hardware or software can detect them.
Citizen Lab warns that news organizations globally may be actively targeted by this emerging threat. The distribution of spyware via advertisements poses a significant security risk not only to potential victims but also to states and civil society.