Ads delivered zero-click spyware to Al Jazeera devices, researchers say

The Short Version

Advertisements delivered spyware to targeted devices without their owners clicking anything, according to a newly reported Citizen Lab investigation. Ars Technica reports that researchers at the University of Toronto identified a campaign they call AdFection and confirmed infections on 45 devices at Al Jazeera during 2024 and 2025. TechCrunch also reports evidence of ad-delivered infections at the media organization.

The news is the investigation into those earlier infections. It should not be read as an announcement that 45 devices were newly compromised this week. The distinction separates when the reported attacks happened from when readers learned about them.

Why It Matters

The important feature is the absence of an extra action by the person being targeted. In the account published by Ars Technica, loading a website or opening an installed app was enough for an advertisement carrying an exploit to install the malware. The reported attacks worked against both iOS and Android devices.

That changes the question a reader should ask about this particular campaign. Rather than asking which suspicious link someone clicked, the relevant issue is how an attack reached a device through an advertisement without that interaction. The practical implication of the reported mechanism is that avoiding suspicious clicks alone would not explain how to prevent these cases. It does not follow that every advertisement carries the same threat.

The Bigger Picture

The confirmed cases described in the reporting concern a media organization. Citizen Lab's warning extends to people working in newsrooms, including journalists, editors and other staff. The researchers also frame targeted-ad delivery as a risk for civil society and states. Those are the researchers' warnings about the implications of their findings, rather than a measurement of infections across the wider population.

The number 45 therefore needs a clear boundary: it describes devices Citizen Lab says it confirmed were infected at Al Jazeera. It cannot, by itself, tell an ordinary reader how likely they are to encounter a similar attack. Ars Technica also reports that detecting these infections requires specialist forensic software or hardware. The report is consequently about both an unobtrusive delivery method and the difficulty of recognizing what happened afterward.

What to Watch

Citizen Lab describes the finding as likely the first confirmation of this type of mercenary spyware being delivered through targeted ads. That wording matters: a first reported confirmation is different from proof that no similar attack happened earlier.

The next useful details would concern the vulnerabilities involved, affected software versions and the status of any fixes. The saved reporting does not establish those points, so it would be premature to promise that one setting or update resolves the campaign. For now, the clearest conclusion is narrower: researchers report a concrete set of infections in which an advertisement, rather than a click by the target, provided the route to a device. Understanding the remaining technical limits is essential to judging how far that finding reaches.

How should online services protect people when avoiding suspicious clicks is not enough?