Ethical Hacking News
A recent report by the University of Toronto's Citizen Lab has confirmed that mercenary hackers have been using targeted ads to deliver zero-click exploits that install sophisticated malware on devices, leaving users vulnerable to espionage and cyber attacks. Ars Technica has uncovered the disturbing discovery and provides an in-depth look at the context and implications of this incident.
Mercenary hackers have been using targeted ads to deliver zero-click exploits that install sophisticated malware on devices, leaving users vulnerable to espionage and cyber attacks. The attacks were carried out by AdFection, a campaign that infected targets with specific profiles of interest to mercenary spyware partners. Discover-Tech, an Israeli company, acts as a facilitator for mercenary spyware partners, using a bidding process to assemble detailed profiles of millions of people. Discover-Tech's ads were displayed in over 70,000 mobile apps and more than 120,000 websites between March and June 2026. Major ad platforms have removed Discover-Tech from their registries, and some have terminated its access to their ad exchange platforms. Users can reduce the risk of being infected by installing ad blockers, resetting mobile advertising ID, and installing ad-blocking software.
Ars Technica has recently uncovered a disturbing discovery that highlights the darker side of targeted advertising. A recent report by the University of Toronto's Citizen Lab has confirmed that mercenary hackers have been using targeted ads to deliver zero-click exploits that install sophisticated malware on devices, leaving users vulnerable to espionage and cyber attacks.
The incident, which is likely the first confirmation of mercenary spyware delivered through targeted ads, involves the use of zero-click exploits that work without requiring any interaction from the target. These exploits are invisible unless users run special forensic hardware or software, making them particularly pernicious. The attacks, which have been confirmed on iOS and Android devices, have already infected 45 devices at an international media organization, Al Jazeera, in 2024 and 2025.
According to the report, the attacks were carried out by AdFection, a campaign named by the Citizen Lab researchers, which infected targets with specific profiles of interest to mercenary spyware partners. The ads were provided by Discover-Tech, an Israeli company that brands itself as a legitimate advertising company, but operates as a facilitator for multiple mercenary spyware partners. Discover-Tech acts as a "bridge between ad vendors and the mercenary spyware ecosystem," a role that appears to be its primary purpose.
The brokering involves a bidding process in which advertisers offer a fee in exchange for their ads appearing on the devices of individuals in particular demographics. Using users' unique mobile ID, location, IP address, and other breadcrumbs, the brokers are able to assemble detailed profiles of millions of people. The Citizen Lab researchers obtained more than 4 billion bidding records handled by Discover-Tech, revealing that Discover-Tech ads were displayed in over 70,000 mobile apps and more than 120,000 websites between March and June 2026.
Major vendors, such as Google and IAB Europe, have since removed Discover-Tech from their ad vendor registries, and Google has further terminated Discover-Tech's access to its ad exchange platforms. Beeswax has removed Discover-Tech from its ad buying platform, and fellow ad platform Vungle (Liftoff) has paused Discover-Tech's access while conducting a review. Eskimi has blocked Discover-Tech's accounts and domains.
The research lab said that the mercenary malware installed through AdFection was developed and distributed by Candiru, a company that has rebranded itself as "Integrity Labs." The malware installed on devices was likely developed and distributed by Candiru, a company that has rebranded itself as "Integrity Labs." Under the arrangement with Discover-Tech, targets with specific profiles of interest to the Candiru customers received ads that carried JavaScript or other code that connected to Candiru's control servers. In response, those servers delivered an exploit that served the zero-click payload when the ad appeared on an individual's device.
The Citizen Lab called on advertisers and government officials to take concrete action to proactively prevent campaigns like AdFection. Beyond that, users can reduce the risk of being infected by installing ad blockers, resetting mobile advertising ID in iOS and Android settings, and installing ad-blocking software on home or office networks. As always, installing updates in a timely manner is also a must.
Related Information:
https://www.ethicalhackingnews.com/articles/AdFection-The-First-Confirmation-of-Mercenary-Spyware-via-Targeted-Ads-ehn.shtml
https://arstechnica.com/security/2026/10/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware/
Published: Thu Oct 15 19:46:44 2026 by llama3.2 3B Q4_K_M
