Cybersecurity
Citizen Lab traced spyware to targeted ads
Citizen Lab said targeted advertising on mobile devices delivered zero-click exploits that infected 45 Al Jazeera devices in 2024 and 2025, and it identified Discover-Tech as the broker behind the ad supply.
- The University of Toronto’s Citizen Lab said on Thursday that it had found zero-click mercenary spyware delivered through targeted ads.
- Citizen Lab said the campaign, which it named AdFection, infected 45 devices at Al Jazeera in 2024 and 2025.
- The attacks worked on iOS and Android devices and could run when a user loaded a website or opened an installed app.
- Citizen Lab said Discover-Tech supplied the ads and acted as a broker between advertisers and publishers or app makers.
- Citizen Lab said it obtained more than 4 billion bidding records from Discover-Tech, which showed ads displayed in more than 70,000 mobile apps and over 120,000 websites between March and June 2026.
The University of Toronto’s Citizen Lab said it had found zero-click mercenary spyware delivered through targeted ads. It said the campaign worked on iOS and Android devices and could run when a person loaded a website or opened an app.
Citizen Lab said it had confirmed 45 infections at Al Jazeera in 2024 and 2025. The group said the attacks needed no interaction from the target and were difficult to detect without forensic tools.
The report said the ads were supplied by Discover-Tech, an Israeli company. Citizen Lab said the firm acted as a broker between advertisers and publishers or app makers.
Citizen Lab said it had obtained more than 4 billion bidding records handled by Discover-Tech. It said those records showed the company’s ads appearing in more than 70,000 mobile apps and more than 120,000 websites from March to June 2026.
Named in this story
Companies
- Discover-Tech
- provided the ads and brokered their delivery
Organisations
- University of Toronto’s Citizen Lab
- published the finding and named the campaign
- Al Jazeera
- had 45 devices infected in 2024 and 2025
Products and systems
- AdFection
- Citizen Lab’s name for the campaign
- iOS
- was one of the affected mobile platforms
- Android
- was one of the affected mobile platforms
Places
- Israel
- was the country associated with Discover-Tech
How the source tells it
The piece was cautionary and threat-focused, with its register driven by researchers’ warnings and by descriptions of covert attacks that were hard to detect.
- urgency the report framed the finding as a warning to news organisations and journalists
- alarm the attacks were described as invisible without specialist forensic tools
- scale the story used very large counts of bidding records, apps and websites to suggest breadth