Attackers have used personalized ads to silently install spy software on smartphones. All it took was for users in the desired target group to visit a website or open an app.
Al Jazeera employee infected
One Citizen Lab investigation at the University of Toronto is now documenting such an attack, in which 45 devices belonging to employees of the Arabic news channel Al Jazeera were infected in 2024 and 2025. According to the researchers, this is likely the first confirmed case in which commercial spy software was distributed via targeted advertising without any input from the victims. The researchers dubbed the campaign “AdFection.” It worked on both iPhones and Android devices.
So-called zero-click attacks are particularly dangerous because those affected do not have to click on a link or open a file. The malware can get onto the device as soon as a website is loaded or an advertisement is displayed. Without specialized forensic tools, an infection usually goes unnoticed.
The focus of the investigation is the Israeli company Discover-Tech. It presents itself as a regular advertising service provider, but according to Citizen Lab it is said to have acted as an intermediary between advertisers and several providers of commercial spy software. The malware used comes from Candiru, a company that now operates under the name Integrity Labs. Discover-Tech arranges advertising space by ad providers submitting bids in an automated process.
Specific groups of people can be targeted using mobile advertising IDs, location data, IP addresses and other information. Citizen Lab evaluated more than four billion bid records. Accordingly, Discover-Tech ads were played in more than 70,000 apps and on over 120,000 websites between March and June 2026.
Precise target group definition
The attacks are said to have worked by displaying ads containing JavaScript or other code that connects target devices to Candiru’s control servers. These then delivered the exploit for the infection. Citizen Lab did not disclose which security gaps were specifically exploited and which malware ultimately ended up on the devices. Discover-Tech was listed as a certified or verified provider by Google and the European advertising industry association IAB Europe, among others. The company also used consent mechanisms under the General Data Protection Regulation to target users in the EU.
After the investigation became known, Google and IAB Europe removed the provider from their directories. Google also blocked access to its advertising exchanges. Other platforms also restricted collaboration or blocked Discover-Tech. According to Citizen Lab, such advertisements were also registered on networks with connections to NATO, the United Nations, European legislative bodies, government agencies and armed forces.
RS News or Research Snipers focuses on technology news with a special focus on mobile technology, tech companies, and the latest trends in the technology industry. RS news has vast experience in covering the latest stories in technology. Can be reached at author2@researchsnipers.com
