Researchers at the University of Toronto's Citizen Lab have confirmed that mercenary hackers embedded zero-click exploits inside targeted advertisements, silently installing sophisticated spyware on the devices of victims who did nothing more than load a webpage or open an app. The campaign, which Citizen Lab named AdFection, infected 45 devices at international media organization Al Jazeera in 2024 and 2025.
What is AdFection and how did zero-click exploits spread through ads?
AdFection is what Citizen Lab calls likely the first confirmed instance of zero-click mercenary spyware delivered through targeted online advertising. Unlike traditional attack vectors that require a victim to click a link, download a file, or approve a prompt, zero-click exploit ads weaponize the ad-delivery infrastructure itself — the same pipes that serve banner images and video pre-rolls — to silently trigger exploitation code the moment a page or app loads.
The mechanics exploit a fundamental asymmetry in how ads work. When a browser or app requests an ad, it executes a chain of automated transactions across ad exchanges, demand-side platforms, and creative delivery networks — all before a user consciously registers that an ad has appeared. Attackers who can inject a malicious payload into that pipeline gain a window of execution that occurs entirely outside the user's awareness. The malware arrives not because the target did something wrong, but because the target was online.
Citizen Lab's Thursday publication confirmed the attacks functioned on both iOS and Android devices, which broadens the threat surface considerably. Neither platform's sandboxing or permission model was sufficient to block an exploit delivered through the ad layer before defenses could engage.
Why are zero-click ad exploits more dangerous than traditional phishing?
Phishing — even sophisticated spear-phishing — depends on a human error. The attacker must craft a believable message, the target must open it, and the target must then click something or interact with a payload. Every one of those steps is an opportunity for the attack to fail. Security training, skepticism, and spam filters all erode the odds.
Read next Laika's Wildwood: Stop-Motion Fantasy at TIFF 2026Zero-click exploit ads eliminate every one of those failure points. The attack requires no deception, no interaction, and no mistake on the part of the target. A journalist loading their regular news feed, an editor checking sources, a bureau chief reviewing a document — any of those routine actions can serve as the trigger if their device has been designated a target and the right ad is served to them.
The invisibility compounds the danger. Citizen Lab noted that infections are undetectable without specialized forensic hardware or software. Ordinary users, IT departments without dedicated threat intelligence tooling, and even experienced security teams relying on standard endpoint monitoring would likely see nothing. The attack leaves no user-facing trace: no unexpected popup, no battery drain spike that registers consciously, no prompt asking for permissions. The spyware simply arrives and begins operating.
That combination — no required interaction, no visible footprint — puts zero-click exploit ads in a category that demands a fundamentally different defensive posture than anything phishing-era threat models anticipated.
Who was targeted and how many devices were confirmed infected?
Citizen Lab confirmed that 45 devices belonging to staff at Al Jazeera, the Doha-based international media organization, were infected across 2024 and 2025. Al Jazeera's newsroom and its journalists, editors, and other personnel represent exactly the profile mercenary spyware operators historically pursue: a high-value target whose communications, sources, and internal deliberations carry significant intelligence interest to a range of state and non-state actors.
The 45-device count is the specific figure Citizen Lab documented and attributed. Extrapolating a broader infection tally beyond that confirmed number would go beyond what the research establishes.
What the research does establish is that this was not opportunistic. AdFection used targeted advertising — meaning the attacker had sufficient knowledge of their victims to configure ad-delivery systems to serve exploits specifically to those individuals. That requires either access to advertising platform targeting parameters, data-broker information, or prior surveillance sufficient to identify and fingerprint the devices in question. The targeting itself is a signal of resources, sophistication, and specific intent.
Citizen Lab researchers stated plainly that the investigation "should serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat," and specified that such targeting "may happen both in newsrooms and to individual journalists, editors, and other staff members."
How can journalists and news organizations detect or prevent ad-delivered spyware?
Detection is the harder problem. Because zero-click exploit ads operate below the threshold of user interaction, behavioral awareness offers no protection. The mitigations that exist operate at the infrastructure level or require dedicated forensic effort.
Citizen Lab's own forensic work — which identified the 45 Al Jazeera infections — relied on specialized tools designed for mobile threat analysis. News organizations with the resources to establish internal security teams or retain threat-intelligence firms can pursue periodic device audits using similar approaches. For smaller outlets, partnerships with organizations like Citizen Lab itself, Access Now's Digital Security Helpline, or similar civil-society security groups represent a more accessible path to detection capability.
On the prevention side, ad-blocking at the network level — through DNS filtering, browser extensions deployed organization-wide, or enterprise proxies that strip ad content — reduces the attack surface by limiting exposure to the ad-delivery pipeline where the exploit rides. This does not eliminate risk, since some zero-click exploit ads may arrive through channels that bypass standard ad-blocking signatures, but it meaningfully raises the cost of attack.
Mobile device management policies that restrict which apps can load external ad content, or that enforce stricter network rules on high-risk devices, add another layer. Keeping device operating systems and apps updated remains foundational, since the exploits Citizen Lab described targeted vulnerabilities that patches may address over time.
No single control closes the exposure entirely. The honest assessment is that zero-click exploit ads represent a threat category where determined, well-resourced attackers retain significant advantage.
What AdFection means for the future of online advertising and digital security
AdFection, if it holds up as the first confirmed case of its kind, marks an inflection point rather than an isolated incident. The advertising ecosystem was designed to deliver scale and targeting precision to commercial buyers. Those same properties — reach, granularity, automation — are exactly what a surveillance-for-hire operation needs to deploy exploits efficiently against specific individuals across the globe.
The mercenary spyware industry has grown increasingly sophisticated over the past decade, moving from narrow SMS-based attacks to browser exploits to app-store delivery attempts. Adding the ad network as a delivery mechanism extends that industry's reach into infrastructure that is nearly impossible to avoid. Virtually every ad-supported website, app, and media property becomes a potential vector.
The implications for the broader advertising industry are uncomfortable. Ad networks and exchanges now face pressure to treat their delivery infrastructure as a potential weapon — one that sophisticated attackers can already wield. That demands investment in supply-chain security, malicious creative detection, and buyer verification that the industry has not historically been structured around.
For journalists and press-freedom advocates, AdFection confirms a threat model that many had theorized but none had documented at this level. The devices of reporters are now provably reachable through the same commercial systems that serve them streaming video and product recommendations. That reality requires a response from newsrooms, platform companies, and policymakers — not just from the security community.
Related coverage
Source: Ars Technica - All content
