Researchers have uncovered a campaign in which hired hackers embedded zero‑click exploits in online advertisements, allowing sophisticated malware to be installed on victims’ devices without any user interaction. The study, released Thursday by the University of Toronto’s Citizen Lab, appears to be the first documented case of mercenary spyware delivered through targeted ads that require no clicks. The malicious code worked on both iOS and Android platforms and remained hidden unless the device was examined with specialized forensic tools.
Citizen Lab identified the operation, dubbed “AdFection,” as having compromised 45 devices belonging to the international news outlet Al Jazeera during 2024 and 2025. The researchers warned that the technique poses a serious threat to media organizations worldwide. “This investigation should… serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat,” the report stated. “This targeting may happen both in newsrooms and to individual journalists, editors, and other staff members.” The analysis added that “the distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.”