Researchers at the University of Toronto’s Citizen Lab have uncovered a concerning new trend in cyber-espionage: targeted ads that deliver zero-click exploits to install sophisticated malware on victims' devices.

The incident, likely the first confirmed case of zero-click mercenary spyware delivered through targeted ads, targets both iOS and Android devices and operates stealthily, requiring no user interaction to infect the device.

AdFection, the campaign that infected 45 devices at international media organization Al Jazeera, is just one of the many examples of how this threat can spread. The ads are provided by Discover-Tech, an Israeli company that, despite its advertising facade, operates as a facilitator for multiple mercenary spyware partners, acting as a “bridge between ad vendors and the mercenary spyware ecosystem.”

The bidding process is revealing, with advertisers offering fees for their ads to appear on users in specific demographics, using unique IDs, locations, and IP addresses to create detailed user profiles. In the period between March and June 2026, Discover-Tech ads were displayed in over 70,000 mobile apps and more than 120,000 websites, raising serious security concerns for news organizations and individuals alike.

These findings underscore the need for heightened vigilance and robust cybersecurity measures in an increasingly complex digital landscape.