Researchers from the University of Toronto’s Citizen Lab reported that mercenary hackers have embedded zero-click exploits in advertisements, which can install sophisticated malware on targeted individuals' devices without any interaction. This finding, published on October 15, 2026, is considered the first confirmation of such mercenary spyware being delivered through targeted ads. The attacks affect both iOS and Android devices and are particularly concerning because they operate without user interaction and remain undetectable unless specific forensic tools are used. Citizen Lab indicated that the campaign, named AdFection, successfully infected 45 devices at the international media organization Al Jazeera between 2024 and 2025. The researchers emphasized that this investigation serves as a warning to news organizations globally, indicating that they may be targeted by this emerging threat, which poses risks not only to potential victims but also to states and civil society.
✓ AI-Debiased Article
4
Wire-neutral
provisional
✓ No loaded language, vague sourcing, or framing detected.
Research Identifies Zero-Click Exploits in Targeted Ads for Malware Installation
A report from the University of Toronto’s Citizen Lab reveals that mercenary hackers have used targeted ads to deliver zero-click exploits that install malware on devices without user interaction. The campaign, named AdFection, has reportedly infected 45 devices at Al Jazeera, highlighting a significant security risk for news organizations and their staff.
Compare the coverage
Annotating as
No note attached
on this article.
Original vs. Neutral
Original Headline
Targeted ads delivered 0-click exploits to install mercenary malware
Neutral Headline
Research Identifies Zero-Click Exploits in Targeted Ads for Malware Installation