Mercenary Hackers Use Targeted Ads to Deliver Spyware to Journalists

Mercenary hackers have exploited targeted advertisements to deliver sophisticated spyware to the devices of journalists, according to a report published by the University of Toronto’s Citizen Lab. The malware, installed through zero-click exploits, infected devices simply by loading a website or opening an installed app. This method, confirmed in 2024 and 2025, is the first known instance of such an attack vector. The campaign, dubbed 'AdFection' by researchers, targeted 45 devices at the international media organization Al Jazeera. The spyware works on both iOS and Android devices, making it a significant threat due to its invisibility and lack of user interaction requirements. Special forensic hardware or software is needed to detect it.

Citizen Lab researchers warned that this method of delivering spyware poses a significant security risk not only to potential victims but also to states and civil society at large. The report highlighted that news organizations worldwide may be actively targeted through this new threat, impacting newsrooms and individual journalists, editors, and other staff members. The findings underscore the evolving tactics used by mercenary hackers to infiltrate devices and extract sensitive information.

The discovery of the AdFection campaign comes as a stark reminder of the sophisticated methods employed by cybercriminals to exploit vulnerabilities in digital advertising. The use of targeted ads to deliver zero-click exploits represents a new frontier in cyber espionage, where even the most cautious users can fall victim to such attacks. The report emphasizes the need for enhanced security measures and vigilance within the media industry to protect against these advanced threats.

CONTEXT: This story matters because it highlights the evolving tactics of mercenary hackers and the vulnerabilities in digital advertising. It underscores the need for heightened security measures in the media industry to protect journalists and their organizations from sophisticated cyber threats. The use of zero-click exploits through targeted ads represents a significant escalation in cyber espionage, posing risks to both individuals and broader civil society.