Zero-Click Mercenary Spyware via Ads: Your Reality Check

Zero-click mercenary spyware, delivered right through the ads you see daily. This isn't a sci-fi plot. It's a stark reality check. Researchers recently uncovered a sophisticated campaign in which mercenary hackers, working with quiet precision and clearly targeting everyday users, injected zero-click exploits directly into the targeted advertisements that quietly load on phones and browsers, silently installing advanced malware on devices. This isn't about clicking a suspicious link or downloading a dodgy app. It's about simply loading a website or opening an app, and your phone gets compromised. This is a major shift. And not in a good way.

Here's the deal: The incident, confirmed by the University of Toronto’s Citizen Lab, marks what is likely the first publicly confirmed instance of zero-click mercenary spyware being spread via the advertising ecosystem. We're talking about iOS and Android devices getting hit. The terrifying part? These attacks demand zero interaction from you. They're invisible. You'd need specialized forensic hardware or software to even know you were breached.

Your Ads, Their Exploits: The Sneaky Mechanism

Think about how many ads you see every day. Now imagine one of those ads isn't just trying to sell you something; it's trying to hack you. This campaign, dubbed AdFection by the researchers, used the very infrastructure of online advertising, and it's a complex chain that starts with data collection.

An Israeli company called Discover-Tech branded itself as a legitimate advertising firm. But researchers looked closer. They concluded its primary purpose was acting as a bridge to the mercenary spyware ecosystem, a role that turned a seemingly ordinary business into a gateway for something far more troubling. This firm served as a broker, connecting parties who wanted to display ads with publishers and app makers seeking revenue. Here's where it gets chilling. Discover-Tech wasn't just showing random ads.

The Data Trail Leading to You

These brokers assemble incredibly detailed profiles of millions of people. How? By using your unique mobile ID, your location data, your IP address, and other digital breadcrumbs. This isn't just for showing you a relevant sneaker ad. This granular data allows them to bid on ad placements that appear on devices belonging to individuals with specific demographics, demographics of interest to their mercenary spyware partners.

The sheer scale is mind-boggling. Researchers obtained over 4 billion bidding records handled by Discover-Tech. These records showed Discover-Tech ads popped up in more than 70,000 mobile apps and over 120,000 websites in just a few months, between March and June 2026. This isn't a niche corner of the internet; this is mainstream.

Who's In The Crosshairs?

Journalists, government officials, and critical infrastructure personnel. That's who. The investigation specifically confirmed that the AdFection campaign infected 45 devices at the international media organization Al Jazeera in 2024 and 2025. This isn't a random consumer hack; it's highly targeted.

"This investigation should … serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat."

Researchers emphasized this targeting could happen in newsrooms. It could also hit individual staff members, like journalists and editors. But the reach goes far beyond media. Discover-Tech ad impressions were detected on networks linked to governments and national security bodies globally, which means we're talking about NATO networks, United Nations systems, European lawmaking bodies, critical infrastructure providers in Australia, and even armed forces and government agencies in Norway and Sweden. This isn't just about privacy. It's about state-level security.

The Spyware's Architects and Enablers

The mercenary malware installed through AdFection was developed and distributed by Candiru, a firm rebranded as "Integrity Labs." Under their deal with Discover-Tech, targets matching specific profiles got ads that contained JavaScript or other code. This code connected to Candiru’s control servers. What happened next? Those servers delivered the actual exploit, deploying the zero-click payload the moment the ad loaded on the target’s device.

This operation exposes deep structural flaws. The online advertising system, as it currently stands, completely failed to detect or prevent this abuse, which is a stunning indictment of an industry that claims to police itself. Major vendors listed Discover-Tech as certified. Google and IAB Europe called them verified. Discover-Tech even used GDPR consent frameworks to target EU users. And they served ads through Google, Yandex, and Beeswax. It's a broken system. We've got certified vendors running wild, and the networks just don't stop them.

The good news? Once these findings came out, action was swift:

• Google and IAB Europe removed Discover-Tech from their ad vendor registries.
• Google also terminated Discover-Tech's access to its ad exchange platforms.
• Beeswax removed Discover-Tech from its ad buying platform.
• Fellow ad platform Vungle (Liftoff) paused Discover-Tech's access while conducting a review.
• Eskimi blocked Discover-Tech's accounts and domains.

This rapid response shows the industry can act. But this threat existed for so long. That's a huge concern. The vulnerabilities exploited by these zero-click attacks and the specifics of the installed malware weren't detailed in the report, and it's highly probable they were zero-days, meaning previously unknown flaws, which have likely been patched since the campaign was discovered. They're likely patched now. We've got no specifics.

Your Reality Check: What You Can Do

So what does this mean for your daily digital life? It means you need to be proactive. Governments and advertisers are called upon to fix the systemic issues, and while that work continues, you're not powerless, because you can reduce your risk significantly. You can't sit back.

Here are some concrete steps:

• Install Ad Blockers: This is your first line of defense. Less ads, less attack surface. Simple.
• Reset Mobile Advertising ID: Both iOS and Android have settings to reset your mobile advertising ID. This can help disrupt the profiling that makes targeted attacks possible. You can find this in your device settings.
• Network-Level Ad Blocking: Consider installing ad-blocking software or hardware on your home or office networks. This protects all devices connected to that network.
• Timely Updates: Always, always install system updates promptly. Patches often fix the very vulnerabilities that zero-day exploits target. This is non-negotiable for security.

This isn't just about protecting your privacy. It's about guarding against sophisticated attacks that can compromise your entire device without you lifting a finger, and that's a threat you can't ignore. The era of zero-click mercenary spyware is here. Vigilance is your best tool.

Frequently Asked Questions

What is zero-click mercenary spyware and how does it differ from traditional malware attacks?

Zero-click mercenary spyware is advanced malware that silently installs on devices without any user interaction, simply by loading a website or opening an app. Unlike traditional attacks that require clicking a suspicious link or downloading a dodgy app, these attacks are invisible and demand zero interaction from the user.

How did the AdFection campaign use the advertising ecosystem to deliver spyware?

The AdFection campaign used the infrastructure of online advertising, starting with data collection by an Israeli company called Discover-Tech that acted as a broker connecting advertisers with publishers. Discover-Tech assembled detailed profiles of millions of people using mobile IDs, location data, IP addresses, and other digital breadcrumbs to bid on ad placements targeting specific demographics, and ads containing JavaScript connected to Candiru's control servers that delivered the zero-click payload.

Who was targeted by the AdFection campaign according to the investigation?

The investigation confirmed that the AdFection campaign infected 45 devices at the international media organization Al Jazeera in 2024 and 2025, specifically targeting journalists, government officials, and critical infrastructure personnel. Discover-Tech ad impressions were also detected on networks linked to governments and national security bodies globally, including NATO networks, United Nations systems, European lawmaking bodies, and critical infrastructure providers in Australia, Norway, and Sweden.

What actions did major advertising platforms take after the AdFection findings were revealed?

Google and IAB Europe removed Discover-Tech from their ad vendor registries, and Google terminated Discover-Tech's access to its ad exchange platforms. Beeswax removed Discover-Tech from its ad buying platform, Vungle (Liftoff) paused Discover-Tech's access while conducting a review, and Eskimi blocked Discover-Tech's accounts and domains.

What practical steps can individuals take to reduce their risk from zero-click mercenary spyware?

Individuals can install ad blockers as a first line of defense to reduce attack surface, and reset their mobile advertising ID on both iOS and Android to disrupt the profiling that makes targeted attacks possible. Network-level ad blocking can protect all devices on a home or office network, and timely system updates should always be installed promptly because patches often fix the vulnerabilities that zero-day exploits target.