How Targeted Ads Become a Pipeline for Zero-Click Mercenary Spyware ⇥ citizenlab.ca

Bill Marczak, et al., of the University of Toronto’s Citizen Lab:

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world.

Jillian Kestler-D’Amours, CBC News:

Citizen Lab said it was able to confirm a targeted spyware attack on Al Jazeera: At least 45 of the Qatar-based news outlet’s devices were infected with spyware via Discover-Tech’s ads in 2024 and 2025, the report said.

[…]

An Al Jazeera Media Network spokesperson told CBC News in an email that it “strongly condemns the targeting of our staff with mercenary spyware.”

This investigation is worth your time; it is disturbing. It solidified two things for me: the display advertising technology stack is a global threat, and behaviourally targeted advertising needs to be banned. Obviously, installing an ad blocker is mandatory now, and any website that relies on anti-ad blockers like Admiral does not respect you.