Skip to content
Threat Feed
Subscribe
high threat

AdFection: Targeted mobile advertising exploited for zero-click spyware delivery

The AdFection campaign, facilitated by the ad-broker Discover-Tech and attributed to the mercenary vendor Candiru, delivers zero-click exploits via targeted mobile advertising to compromise iOS and Android devices.

Triage facts

Revision 1
Applicability
Integrity Labs Spyware, Discover-Tech (ad brokering services)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 21, 07:58 UTC
Source quality
A1Very likely

Citizen Lab identified the AdFection campaign, which leverages a malicious advertising pipeline to deliver zero-click exploits to mobile devices. Discover-Tech, an ad-brokering firm, served as the distribution bridge, allowing mercenary spyware developers to bid on ad impressions targeting specific user demographics based on mobile IDs, location, and IP addresses. Once a targeted individual loaded a webpage or opened an app containing the malicious ad, the device executed code that connected to Candiru's (rebranded as Integrity Labs) command-and-control servers, resulting in a zero-click exploit delivery. The campaign was confirmed to have infected 45 devices at Al Jazeera between 2024 and 2025.

Attack Chain

  1. Profiling: Attackers assemble detailed user profiles using unique mobile IDs, location, and IP addresses.
  2. Brokering: The malicious ad is placed into the legitimate advertising ecosystem via the Discover-Tech brokerage.
  3. Delivery: The target loads a webpage or opens a mobile application that displays the malicious advertisement.
  4. Execution: JavaScript or similar code within the advertisement executes upon rendering.
  5. C2 Communication: The executing code initiates a connection to infrastructure controlled by Candiru (Integrity Labs).
  6. Exploitation: The C2 infrastructure delivers a zero-click exploit payload to the target device, leading to full infection.

Impact

Citizen Lab confirmed 45 infections at Al Jazeera between 2024 and 2025. The malware facilitates persistent spyware infection, enabling invisible monitoring of targeted journalists, government officials, and critical infrastructure personnel.

Recommendation

  • Implement network-level ad-blocking solutions across corporate and newsroom environments to disrupt the delivery of malicious ad creative.
  • Enforce regular mobile operating system and application updates to mitigate the zero-click vulnerabilities leveraged in this campaign.
  • Advise high-risk individuals to reset mobile advertising identifiers regularly and consider disabling personalized ad tracking at the OS level.
  • Configure mobile device management (MDM) policies to restrict unnecessary application permissions and background data access.

Immediate actions

Deploy network-level ad blocking to prevent loading of ad exchange domains.

SOC 48h

Mitigations

Mandate OS and application updates on all mobile devices managed by the organization.

immediate IT Operations

Zero-click exploit delivery