Tech

Targeted ads delivered 0-click exploits to install mercenary malware

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 16/10/2026, 15:43:25 UTC.

Briefings

Citizen Lab confirmed that mercenary hackers laced targeted ads with zero-click exploits to install spyware on iOS and Android devices. The campaign, named AdFection, infected 45 devices at Al Jazeera in 2024 and 2025. Researchers warn this represents a security risk for news organizations and journalists, potentially targeting staff members in newsrooms. The attacks require no user interaction and are invisible without specialized forensic tools.

Key points

• Citizen Lab confirmed AdFection campaign infected 45 devices at Al Jazeera in 2024 and 2025 using zero-click exploits.
• The attacks work without user interaction, requiring only website loading or app opening to install spyware.

Context

Citizen Lab, based at the University of Toronto, published findings on October 15, 2026, identifying AdFection as a new threat vector. This represents the first confirmed confirmation of zero-click mercenary spyware delivered through targeted ads, affecting international media organizations.

Limitations

Evidence covers only 45 devices at Al Jazeera in 2024 and 2025. The report does not specify geographic locations beyond Al Jazeera, nor does it provide data on the total number of devices infected globally or the specific number of journalists targeted.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 25/10/2026, 10:34:52 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeifzplzbfrxbryhlgzbb3dmc2c67eda7bjdfikhlk5dd7std2nncjm