Targeted ads delivered 0-click exploits to install mercenary malware

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app. The finding, published Thursday by the University of Toronto’s Citizen Lab, said the incident is likely to be the first confirmation of zero-click mercenary spyware delivered through targeted ads.

研究人员表示，雇佣黑客在广告中植入了“零点击”漏洞利用程序，当目标用户仅仅是加载网页或打开已安装的应用程序时，这些程序就会在他们的设备上安装复杂的恶意软件。多伦多大学公民实验室（Citizen Lab）周四发布的研究结果称，这很可能是首次证实通过定向广告传播的“零点击”雇佣间谍软件。

The attacks, which worked on iOS and Android devices, are particularly pernicious because they work without requiring any interaction from the target and are invisible unless users run special forensic hardware or software. Citizen Lab said it confirmed that AdFection, as it named the campaign, infected 45 devices at international media organization Al Jazeera in 2024 and 2025.

这些攻击适用于 iOS 和 Android 设备，其危害性尤为严重，因为它们无需目标用户进行任何交互即可生效，且除非用户运行专门的取证硬件或软件，否则无法察觉。公民实验室表示，他们已证实名为“AdFection”的行动在 2024 年和 2025 年期间感染了半岛电视台（Al Jazeera）的 45 台设备。

“This investigation should … serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat,” Citizen Lab researchers wrote. “This targeting may happen both in newsrooms and to individual journalists, editors, and other staff members.” Their report went on to say: “The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.”

公民实验室的研究人员写道：“这项调查应该……向全球新闻机构发出明确的警告信号，即他们可能正成为这种新威胁的积极攻击目标。这种针对性攻击可能发生在新闻编辑室，也可能针对个别记者、编辑和其他工作人员。”他们的报告进一步指出：“通过定向广告分发间谍软件，不仅对潜在受害者构成安全风险，也对国家和整个公民社会构成了威胁。”

The ads were provided by Discover-Tech, an Israeli company that brands itself as a legitimate advertising company, but Citizen Lab said it operates as a facilitator for multiple mercenary spyware partners. The company acts as a broker between parties that want to display their ads and publishers or app makers that seek revenue in return for showing them. In this capacity, Discover-Tech acts as a “bridge between ad vendors and the mercenary spyware ecosystem,” a role that appears to be “Discover-Tech’s primary purpose,” Citizen Lab said.

这些广告由以色列公司 Discover-Tech 提供，该公司自称为合法的广告公司，但公民实验室称其实际上是多个雇佣间谍软件合作伙伴的推动者。该公司在希望投放广告的各方与寻求通过展示广告获取收入的发布商或应用开发者之间充当中间人。公民实验室表示，Discover-Tech 在此过程中充当了“广告供应商与雇佣间谍软件生态系统之间的桥梁”，这似乎是“Discover-Tech 的主要目的”。

The brokering involves a bidding process in which advertisers offer a fee in exchange for their ads appearing on the devices of individuals in particular demographics. Using users’ unique mobile ID, location, IP address, and other breadcrumbs, the brokers are able to assemble detailed profiles of millions of people. Citizen Lab said it obtained more than 4 billion bidding records handled by Discover-Tech. They revealed that Discover-Tech ads were displayed in over 70,000 mobile apps and more than 120,000 websites between March and June 2026.

这种中介业务涉及竞价过程，广告商支付费用以换取其广告出现在特定人群的设备上。通过利用用户的唯一移动设备 ID、位置、IP 地址和其他痕迹，中间商能够拼凑出数百万人的详细画像。公民实验室称，他们获得了超过 40 亿条由 Discover-Tech 处理的竞价记录。这些记录显示，在 2026 年 3 月至 6 月期间，Discover-Tech 的广告在超过 7 万个移动应用程序和 12 万个网站上进行了展示。

Among the major vendors that listed Discover-Tech as a “certified” or “verified” vendor were Google and the advertising industry association IAB Europe. The Israeli firm also used European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union. Discover-Tech has served ads through major networks such as Google, Yandex, and Beeswax. Google and IAB Europe have since removed Discover-Tech from their ad vendor registries, and Google further terminated Discover-Tech’s access to its ad exchange platforms.

将 Discover-Tech 列为“认证”或“验证”供应商的主要厂商包括谷歌和广告行业协会 IAB Europe。这家以色列公司还利用欧盟《通用数据保护条例》（GDPR）的同意框架来锁定欧盟境内的用户。Discover-Tech 通过谷歌、Yandex 和 Beeswax 等主要网络投放广告。此后，谷歌和 IAB Europe 已将 Discover-Tech 从其广告供应商名录中移除，谷歌还进一步终止了 Discover-Tech 对其广告交易平台的访问权限。

Thursday’s report said that Discover-Tech ad impressions have appeared on government and national-security-linked networks throughout the world: NATO, United Nations networks, European lawmaking bodies, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden. “Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” Citizen Lab said.

周四的报告称，Discover-Tech 的广告展示曾出现在全球各地的政府和国家安全相关网络中，包括北约、联合国网络、欧洲立法机构、澳大利亚的关键基础设施提供商，以及挪威和瑞典的武装部队和政府机构。公民实验室表示：“Discover-Tech 的大规模滥用、隐私侵犯以及为雇佣间谍软件攻击提供便利，说明了在线广告系统存在结构性缺陷，未能检测或阻止本报告中记录的滥用行为。”

The research lab said that the mercenary malware installed through AdFection was developed and distributed by Candiru (rebranded as “Integrity Labs”). Under the arrangement with Discover-Tech, targets with specific profiles of interest to the Candiru customers received ads that carried JavaScript or other code that connected to Candiru’s control servers. In response, those servers delivered an exploit that served the zero-click payload when the ad appeared on an individual’s device.

该研究实验室表示，通过 AdFection 安装的雇佣恶意软件是由 Candiru（现更名为“Integrity Labs”）开发和分发的。根据与 Discover-Tech 的安排，符合 Candiru 客户特定画像的目标用户会收到带有 JavaScript 或其他代码的广告，这些代码会连接到 Candiru 的控制服务器。随后，当广告出现在用户的设备上时，这些服务器会发送一个漏洞利用程序，从而植入“零点击”有效载荷。

The research doesn’t describe the vulnerabilities exploited in the zero-click attacks or the final malware that was installed in them. It’s likely they were zero-days that have been fixed after Citizen Lab discovered the campaign. Citizen Lab didn’t immediately respond to questions. Messages sent to Discover-Tech and Candiru went unanswered.

该研究并未描述“零点击”攻击中利用的漏洞，也未说明最终安装的恶意软件。这些漏洞很可能是“零日漏洞”，在公民实验室发现该行动后已得到修复。公民实验室未立即回应置评请求。发送给 Discover-Tech 和 Candiru 的消息也未得到回复。

Citizen Lab called on advertisers and government officials to take concrete action to proactively prevent campaigns like AdFection. Beyond that, users can reduce the risk of being infected by installing ad blockers, resetting mobile advertising ID in iOS and Android settings, and installing ad-blocking software on home or office networks. As always, installing updates in a timely manner is also a must.

公民实验室呼吁广告商和政府官员采取具体行动，主动预防类似 AdFection 的行动。此外，用户可以通过安装广告拦截器、在 iOS 和 Android 设置中重置移动广告 ID，以及在家庭或办公网络中安装广告拦截软件来降低感染风险。一如既往，及时安装更新也是必不可少的。