Israeli spyware firms in 2024 targeted devices used by Al Jazeera staff with a newly identified infection technique dubbed "adfection," according to reporting. The attacks are described as "zero‑click" intrusions, meaning the spyware could be delivered and activated without the user having to open a link, click an attachment or otherwise interact with malicious content.
What 'zero‑click' and 'adfection' mean
"Zero‑click" refers to exploits that activate simply by receiving data or content — for example, an incoming message, a push notification or content rendered by an application — rather than requiring a user to take an action. The term "adfection" combines advertising and infection: researchers say the delivery vector appears to involve advertising infrastructure or ad content that carries the exploit payload into a target device's environment.
How the attacks reportedly worked
According to the reporting, the technique leverages ad networks or ad content to present malicious code that can trigger a vulnerability when the device processes the advertisement. Because the exploit is embedded in content that is routinely fetched and rendered by apps or browsers, the user does not need to click or interact for the exploit to run. Once the vulnerability is exploited, spyware can be installed to monitor communications, location and other device data.
Targets, risks and implications
Al Jazeera staff were among the targets identified in the 2024 incidents, raising concerns about surveillance of journalists and the broader risks to press freedom. Zero‑click methods are particularly worrisome for high‑risk individuals because they are difficult to detect and defend against: conventional warnings about suspicious links or attachments are ineffective when no user action is required.
Wider context and response
Security researchers and privacy advocates say the emergence of ad‑based delivery mechanisms underscores vulnerabilities in the digital advertising ecosystem and in widely used apps and operating systems. The incidents add to ongoing debate about oversight of commercial spyware vendors and the need for improved security practices, timely patching of vulnerabilities and greater transparency from ad networks and platform operators.
While details about specific vulnerabilities or the precise mechanics of each intrusion remain technical and under investigation, the reported use of "adfection" highlights how attackers are adapting delivery methods to evade detection and expand the reach of surveillance tools.