Targeted ads delivered 0-click exploits to install mercenary malware

Researchers from the University of Toronto’s Citizen Lab have uncovered a sophisticated spyware campaign dubbed 'AdFection,' which utilizes zero-click exploits delivered through targeted advertisements. This method allows attackers to install malware on both iOS and Android devices without any user interaction, simply by loading a website or opening an app. The campaign was identified after infecting 45 devices belonging to staff at the international media organization Al Jazeera between 2024 and 2025. Citizen Lab warns that this represents a significant evolution in mercenary spyware, as it bypasses traditional security awareness by requiring no clicks or downloads from the victim. The researchers emphasize that this threat poses a major risk to journalists and news organizations globally, urging them to adopt more rigorous forensic monitoring to detect such invisible intrusions. This discovery highlights the growing danger of weaponized digital advertising in targeted surveillance operations.