Citizen Lab researchers identified a campaign dubbed AdFection, which utilized targeted advertisements to deliver zero-click exploits. The malware, developed by Candiru, also known as Integrity Labs, successfully infected 45 devices belonging to Al Jazeera staff between 2024 and 2025.
The Israeli firm Discover-Tech facilitated these attacks by acting as a broker between advertisers and publishers. Between March and June 2026, the company displayed ads across more than 70,000 mobile applications and 120,000 websites, leveraging over 4 billion bidding records to profile users.
Discover-Tech utilized user data, including IP addresses and location, to target specific demographics. Ad impressions were detected on networks linked to NATO, the United Nations, European legislative bodies, and government agencies in Norway and Sweden, as well as critical infrastructure in Australia.
Following the disclosure, major platforms including Google, IAB Europe, and Beeswax removed Discover-Tech from their vendor registries. Other platforms, such as Vungle and Eskimi, have suspended or blocked the company's access to their services.
The exploits functioned on both iOS and Android devices without requiring user interaction. Citizen Lab recommends that users employ ad blockers, reset mobile advertising IDs, and ensure software updates are installed promptly to mitigate risks.
