Key Takeaways
- Researchers confirm zero-click exploits in targeted ads.
- AdFection campaign infected 45 devices at Al Jazeera.
- Security risk highlighted for news organizations and civil society.
Researchers from the University of Toronto’s Citizen Lab have uncovered a sophisticated cyber-attack targeting journalists and media organizations through targeted advertisements. The attack, named AdFection, utilized zero-click exploits to install malware on the devices of targeted individuals, compromising their security without any user interaction.
The malware was designed to work on both iOS and Android devices, making it particularly pernicious as it can operate invisibly, undetected by standard security measures.
According to the Citizen Lab, the campaign infected 45 devices at the international media organization Al Jazeera in 2024 and 2025. This incident is believed to be the first confirmed case of zero-click mercenary spyware delivered through targeted ads.
Citizen Lab researchers warn that this threat is not limited to Al Jazeera but could extend to other news organizations and individual journalists, editors, and staff members. They emphasize the need for heightened security measures and the importance of running special forensic hardware or software to detect such threats.
The findings highlight the growing threat of targeted cyber-attacks, particularly in the realm of digital journalism. The researchers state, 'This investigation should serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat.'
The distribution of spyware via targeted ads represents a significant security risk for potential victims, as well as for states and civil society at large. The incident underscores the need for robust cybersecurity measures and increased vigilance among media professionals.
Citizen Lab’s report concludes that the AdFection campaign is a serious threat that requires immediate attention and action. The researchers urge news organizations to take proactive steps to protect their digital assets and the safety of their staff.
