Citizen Lab Says Targeted Ads Delivered Zero-Click Spyware to Al Jazeera Devices
Citizen Lab says mercenary hackers used targeted ads to deliver zero-click exploits that infected 45 Al Jazeera devices in 2024 and 2025, likely the first confirmed case of ad-delivered zero-click mercenary spyware.
The attacks affected iOS and Android devices, according to the report. They are particularly pernicious because they work without requiring any interaction from the target and remain invisible unless users run special forensic hardware or software, Citizen Lab said. The group named the campaign AdFection.
Citizen Lab said it confirmed that AdFection infected 45 devices at the international media organization Al Jazeera in 2024 and 2025. The report tied the targeting to an international news outlet and warned that the threat may extend to other news organizations.
In its report, Citizen Lab researchers wrote that the investigation “should … serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat.” The researchers added: “This targeting may happen both in newsrooms and to individual journalists, editors, and other staff members.”
The report also said: “The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.”