The University of Toronto's Citizen Lab reported that mercenary hackers used targeted advertisements to deliver zero-click exploits that installed sophisticated malware on iOS and Android devices. The research team stated that the campaign, which they named AdFection, is likely the first confirmed instance of zero-click mercenary spyware distributed through ads.
The attack method required no interaction from the target. Malware installed simply by loading a website or opening an installed application. Citizen Lab researchers noted that these infections are invisible unless users employ special forensic hardware or software to detect them.
The lab confirmed that AdFection infected 45 devices belonging to international media organization Al Jazeera during 2024 and 2025. In their report, the researchers described the incident as a clear warning to news organizations globally that they may be actively targeted by this new threat. They specified that targeting could occur within newsrooms or against individual journalists, editors, and other staff members.
Citizen Lab added that the distribution of spyware via targeted ads poses a security risk for potential victims, states, and civil society at large.