Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app.

The finding, published Thursday by the University of Toronto’s Citizen Lab, said the incident is likely to be the first confirmation of zero-click mercenary spyware delivered through targeted ads. The attacks, which worked on iOS and Android devices, are particularly pernicious because they work without requiring any interaction from the target and are invisible unless users run special forensic hardware or software. Citizen Lab said it confirmed that AdFection, as it named the campaign, infected 45 devices at international media organization Al Jazeera in 2024 and 2025.

A clear warning signal

“This investigation should… serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat,” Citizen Lab researchers wrote. “This targeting may happen both in newsrooms and to individual journalists, editors, and other staff members.” Their report went on to say: “The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.”

Read full article

Comments

Following a string of incidents where AI models hacked websites and breached government systems during testing phases, the Federal Trade Commission is officially probing Anthropic and OpenAI over consumer harms, an insider told Axios.

On Wednesday, the FTC sent out civil investigative demands seeking a wide range of information from the AI firms on recent safety incidents.

The FTC did not respond to Ars’ request to review the subpoena demands. However, Axios’ source said the requests spanned more than 50 pages of questions and sought documents related to the incidents, internal security measures taken, and marketing materials that may suggest consumers were misled.

Read full article

Comments

Experts are warning that the UK is unprepared for crises. A refrigerator cyber-attack scare in France is the latest reminder of the risks

What’s worrying French supermarket bosses should be prompting British ministers to action. On Sunday, hackers forced up the temperatures of refrigerators in hundreds of food stores across France to as high as 50C, resulting in waste and fires. Beyond the immediate destruction and inconvenience, it raised the prospect of other malicious actors finding new ways to play havoc with the food chain.

Only weeks before, 150 experts together warned the British government that it does not have a plan to feed people in a crisis ­– and that the west is entering an era in which not only disruption but the weaponisation of food is a real possibility. “The public has been led to assume that food will simply be there,” they wrote. “It may not be.”

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.