Researchers from the University of Toronto’s Citizen Lab identified a campaign dubbed “AdFection” that leveraged targeted ads to deliver zero-click exploits. The attack...
Tech consumers, gadget buyers, and developers are now at risk from a new zero-click exploit. A security flaw in FortiOS has been exploited to deliver spyware via targeted ads, marking the first confirmed case of such attacks.
AdFection Campaign
Researchers from the University of Toronto’s Citizen Lab identified a campaign dubbed “AdFection” that leveraged targeted ads to deliver zero-click exploits. The attack infected 45 devices belonging to Al Jazeera during 2024 and 2025. The malware, installed without requiring user interaction, silently executed on iOS and Android devices. Citizen Lab confirmed the campaign’s connection to an Israeli-registered advertising firm linked to servers controlled by a spyware company. Zero-click attacks are particularly dangerous because they evade detection by standard security tools and leave no trace unless forensic tools are used.
PEERSTITCH Malware
The exploit delivered a previously unreported memory-resident ARM64 malware named PEERSTITCH. This malware resides in memory, making it harder to detect and remove. The attack exploited a path traversal flaw in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, identified as CVE-2025-61624 (CVSS score: 5.4). The vulnerability allowed attackers to execute arbitrary code remotely, enabling the installation of PEERSTITCH without user action. The malware’s memory-residency and stealth capabilities suggest it is designed for long-term persistence and data exfiltration.
FortiOS Vulnerability
The attack exploited a critical flaw in FortiOS’s command line interpreter, enabling remote code execution. CVE-2025-61624, a path traversal vulnerability, allowed attackers to bypass security mechanisms and deploy malware through targeted ads. The exploit’s success highlights the risks of unpatched systems, as the vulnerability could be exploited by any entity with access to the affected infrastructure. FortiOS users are advised to apply patches and monitor for unusual network activity to mitigate potential risks.
Frequently Asked Questions
Q1: How was the attack confirmed?
Citizen Lab verified the attack through technical analysis of infected devices and confirmed the connection to the AdFection campaign. The findings were published as part of their research on digital ad-based malware.
Q2: What is PEERSTITCH?
PEERSTITCH is a memory-resident ARM64 malware designed to evade detection. It was deployed via zero-click exploits and is believed to be used for data exfiltration and long-term surveillance.
Q3: Which systems were targeted?
The attack targeted iOS and Android devices. The exploit relied on vulnerabilities in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, which are used in enterprise and consumer-grade networking equipment.