Just when we thought targeted ads couldn't get any worse, these were found serving malware

Researchers uncovered a zero-click spyware campaign delivered through online advertisements, requiring no user interaction Journalists’ devices were infected with surveillance malware capable of stealing data, messages, audio, and video Investigation linked the operation to Israeli firms tied to ad-tech infrastructure and commercial spyware Imagine this: You’re a journalist.

You get to work, log into your computer, and go about your daily activities.

While browsing the internet, you see an ad for earbuds.

You don’t click the ad, you don’t even view it with interest.

You just get it served, much like any other ad on the internet, and scroll away to continue with your day.

But the moment the ad was served, through it your computer was infected with a powerful infostealer.

The malware harvested all sorts of sensitive data, including files, documents, cookies, bookmarks, even saved credentials.

It captured your keystrokes, took screenshots while you were working, and was even able to use your microphone and camera to record you while you were working.

Email messages, as well as instant messages shared through a wide range of platforms, were picked up and exfiltrated, as well.

Mission impossible While this might sound like a scene from a Mission Impossible movie, unfortunately it’s completely real.

The victims in this story are Al Jazeera journalists (among others).

In 2024, some of the journalists noticed their devices acting strange, so they reached out to Canadian cybersecurity firm Citizen Lab, who confirmed the first-ever case of zero-click mercenary spyware attack that was delivered through online ads.

They’re calling it “AdFection”.

Both Al Jazeera and Citizen Lab have released their findings, and while the question of who might be attacking journalists remains unanswered, the researchers know who facilitated it - two Israeli companies, one of which has been on the US blacklist for half a decade now.