Researchers Uncover Zero-Click Spyware Delivered Through Digital Ads

Researchers have uncovered what they describe as the first publicly confirmed case of mercenary spyware being delivered through targeted digital advertising without requiring victims to click a link, open an attachment or otherwise interact with the malicious content.

The investigation, published on Oct. 15 by the University of Toronto’s Citizen Lab, found that an Israeli advertising technology company called Discover-Tech provided infrastructure that allowed Spyware operators to identify specific devices through online advertising and potentially infect selected targets as soon as an advertisement was displayed.

Researchers dubbed the technique “AdFection.”

Spyware delivered through ordinary online advertising

According to Citizen Lab’s investigation, Discover-Tech operated a platform called Controlium that could use advertising identifiers, IP addresses and other device information to identify and profile individuals. Once a selected device received an advertisement, additional code could be delivered automatically.

Citizen Lab said the architecture demonstrated that “the simple display of a targeted ad is enough for infection.”

For the best of our weekly content！

You are now signed up for our newsletter

Check your email to complete sign up

Unlike conventional phishing attacks, the victim did not need to click the advertisement. In some cases, Citizen Lab said, the ad could even render in the background while a person was using an otherwise legitimate website or application.

Wolfie Christl, a senior researcher at Citizen Lab, told Reuters that “the way online advertising works today is a systemic security threat.”

The researchers linked the technique with high confidence to spyware developed by Israeli surveillance company Candiru, which has also operated under the name Integrity Labs. The U.S. Commerce Department added Candiru to its Entity List in 2021, saying the company had supplied spyware to foreign governments that used it to maliciously target journalists, government officials, activists, academics and others.

Citizen Lab’s strongest evidence came from Al Jazeera. Researchers said at least 45 devices within the news organization were targeted in zero-click attacks during 2024 and 2025. Network logs showed infected devices first contacting Discover-Tech infrastructure, followed by Candiru validation servers and ultimately Candiru command-and-control infrastructure.

The scale of Discover-Tech’s advertising operation was much larger than the confirmed spyware infections. Citizen Lab analyzed nearly four billion exposed advertising-bid records and found Discover-Tech ads had appeared across more than 120,000 websites and over 70,000 mobile applications between March and June 2026.

Researchers also found the advertisements appearing on networks associated with governments, armed forces, national cybersecurity agencies, the United Nations, NATO and European Union institutions. However, the presence of an advertisement does not establish that those organizations were infected with Spyware.

Citizen Lab researcher Bill Marczak warned in comments to TechCrunch that Discover-Tech is “surely just the tip of the iceberg.”

Google and ad companies move to cut off Discover-Tech

The findings triggered rapid reactions across the digital advertising industry, raising questions about how a company allegedly facilitating Spyware operations was able to gain access to major advertising exchanges.

Discover-Tech had appeared on approved or certified vendor lists maintained by Google and IAB Europe. Google told Reuters that it collaborated with Citizen Lab and Confiant during the investigation and removed Discover-Tech from its advertising platforms “for systematically violating our policies.”

IAB Europe has also suspended Discover-Tech from its Global Vendor List after an audit identified violations of its policies. In an Oct. 15 statement, the organization said further confirmation of the Spyware findings “could also justify a definitive expulsion from the GVL.”

Other advertising companies have followed. Comcast-owned Beeswax removed Discover-Tech from its platform following its own review and third-party security analysis. A company spokesperson told WIRED, “We maintain a zero-tolerance policy for malicious advertising.”

Vungle owner Liftoff paused Discover-Tech’s access while conducting an internal review, while advertising platform Eskimi blocked the company’s accounts and domains. Eskimi told Citizen Lab that Discover-Tech’s advertising tags had been structured to evade automated security scanning by returning different code depending on the device, IP address and location.

Volasim, another company identified during the investigation, acknowledged using Discover-Tech as an outside advertising provider but denied any involvement in spyware activity. Citizen Lab said Discover-Tech, Candiru/Integrity Labs, Microsoft Advertising’s Xandr and Chinese ad-tech company Sunteng were among the companies that did not respond to its requests for comment before its publication deadline. Reuters separately reported that Yandex did not respond to its request for comment.

Al Jazeera, meanwhile, condemned the attacks on its employees. In a statement reported by the network, it described the targeting of journalists as an “assault on press freedom and the public’s right to knowledge” and called for those responsible to be held accountable.

Cybersecurity specialists say the significance of AdFection extends beyond the individual Spyware campaign because it exposes how the architecture of targeted advertising can be repurposed for surveillance.

The same real-time bidding systems that allow advertisers to identify particular devices and serve them customized ads can potentially allow a sophisticated attacker to find a chosen target, win the auction for that person’s screen and send malicious code instead.