Citizen Lab analysts found that zero-click spyware infected phones and laptops through targeted online ads without needing any user action. The team at Toronto University showed that Israeli ad firm Discover-Tech routed Candiru exploit traffic to staff at Al Jazeera. It’s the first public proof that commercial spy software reached real targets through web ad auctions. No links were clicked [1].
How Zero-Click Spyware Entered Online Ad Streams
Zero-click exploits break into phones without relying on phishing links or careless downloads, allowing state clients to deliver contract spyware by exploiting software flaws in messaging tools or chat apps. Citizen Lab senior researcher Bill Marczak said this campaign, dubbed “AdFection,” merged private spy tools with the massive flow of digital ad bidding across thousands of daily web auctions. Targets didn’t need to tap a link or open any file for the break-in to take place. The risk comes without warning. “AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet,” Bill Marczak said [3].
The attack began when targeted devices loaded online ads placed by Discover-Tech, an ad firm registered in Israel in 2020. Each ad carried a small piece of code designed to quietly report the device IP address and ad ID back to a remote Discover-Tech server. Because the ad creative held no attack code, ad networks saw nothing odd. Discover-Tech servers then checked whether the device matched an intended state target [1].
If the device was not on the target list, the ad system sent a normal banner or nothing at all. The server sent nothing back. When a target matched, the server pushed exploit code straight to the browser or mobile app. “Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all,” Bill Marczak said. Citizen Lab senior researcher Wolfie Christl called the findings a nightmare scenario for people browsing the open web, where regular ad traffic can infect hardware without user error [3].
Targeting Al Jazeera Through Israeli Firm Discover-Tech
The probe began after Al Jazeera staff spotted odd network traffic and shared device logs with the Toronto team, leading Citizen Lab to conclude that operators targeted at least 45 devices between 2024 and 2025. In hacked hardware, traffic logs showed a matching chain: a device contacted a Discover-Tech ad server, reached a screening server, and connected to Candiru command servers [1].
Al Jazeera staff pulled a Windows program file from one of the hacked computers during system cleanup work. Citizen Lab analysts disassembled the program and matched its unique coding style to a Candiru tool studied in 2021, linking the attack to the Israeli developer. The team published indicators for defenders, listing SHA-256 hash 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 and ad server domain mtrtb.com, noting that the United States government blacklisted Candiru in 2021 over surveillance abuses against reporters and activists. Defenders can block those domains. While Candiru tools hit Windows machines, the broader ad attack chain can target mobile devices just as easily across web sessions [1].
News staff at Al Jazeera had faced digital tracking before. In 2020, dozens of Al Jazeera reporters had iPhones hacked with NSO Group’s Pegasus spyware through chat app flaws, before Candiru assets were acquired in 2025 by American investment group Integrity Partners and shifted to Integrity Labs. Personal phones rarely keep deep logs. Bill Marczak said Al Jazeera network monitoring made this probe possible [3].
Real-Time Bidding Mechanics Behind Mercenary Spyware Ads
The attack method exploits real-time bidding, an automated auction system where companies buy and sell web ad views in milliseconds. When a user opens a webpage or launches an app, ad systems broadcast device details, including location data and hardware tags, to thousands of bidders competing in real-time ad auctions. Discover-Tech ran an ad tool called Controlium, which Citizen Lab said allowed buyers to de-anonymize, profile, and infect targeted devices when an ad loaded, fitting the exact needs of state spy buyers. “The ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem, and is perfectly suited to the mercenary spyware industry,” Bill Marczak said [3].
Ad-based attacks bypass many barriers that protect modern operating systems from rogue messages. Zero-click exploits pose grave risks because targets make no errors, contrasting with hardware bugs like our report on how Google Pixel phones patched a zero-click modem flaw, as these ad exploits run in regular web sessions. “Until this architecture changes, or ad companies get serious about customer vetting, we’re going to keep seeing this kind of abuse,” Bill Marczak said. Discover-Tech chief executive officer Dekel Boni did not reply to requests for comment [3].
Security experts have warned about ad-based malware delivery for years, but public proof of an active campaign hadn’t surfaced until now. In December, leaked papers tied rival vendor Intellexa to an ad tool named Aladdin, though researchers had not seen it deployed in live attacks, while Jason Kint of trade group Digital Content Next warned that zero-click ad attacks damage user trust on the open web. Intelligence agencies like the NSA and CIA already advise staff to block web ads [3]. Filtering ads is now a baseline defense.
Global Reach and Institutional Networks Under Scan
Discover-Tech’s ad reach stretched far beyond news devices. Citizen Lab examined exposed bidding logs on Discover-Tech’s site and found that ads carrying callback code appeared in more than 70,000 mobile apps and over 120,000 websites, placing nearly four billion bids through a single ad exchange between March and June 2026. Confiant, an ad-security firm working with Citizen Lab, estimated that Discover-Tech handled roughly 10 million ads a day during peak operations [1].
Ad bids from Discover-Tech appeared on high-profile networks worldwide, touching systems tied to NATO, United Nations bodies, lawmaking agencies in the European Union, chipmakers, and news outlets in two dozen countries, though the team noted that ad views alone don’t prove malware infections. In Northern Europe, traffic reached networks used by armed forces and state bodies in Norway and Sweden, as well as critical infrastructure providers in Australia, showing how far automated bids traveled. Confiant found that specific ads linked to Candiru ran at low volume and mainly targeted home Wi-Fi and mobile data connections [1]. Sensitive state networks saw fewer payload runs. Bill Marczak explained that targets on home networks rarely have deep logging tools to spot intrusions [3].
The broad spread of Discover-Tech ads shows how easily targeted tracking tools can scan networks worldwide without triggering alarms, because security firewalls rarely treat incoming bids across publishing sites as rogue traffic. Organizations can check their network logs for the connection pattern documented by Citizen Lab [1].
Tech Platforms Cut Off Discover-Tech Accounts
After Citizen Lab and Confiant shared their evidence in early October 2026, major tech firms and trade bodies moved to cut off Discover-Tech. Google and IAB Europe had both listed Discover-Tech as an approved vendor since 2020, but both groups dropped the firm once investigators confirmed the spyware link, prompting Google to expel the vendor from its ad exchanges and activate Safe Browsing warnings. A Google spokesperson said the company blocked the firm for “systematically violating our policies” [1]. The vendor lost its approved status. “We also set up Safe Browsing warnings to help protect people if they navigate to websites linked to this group,” the Google spokesperson said [3].
Other ad tech networks acted to close Discover-Tech accounts after reviewing the research findings. Beeswax, an ad tech firm owned by Comcast, removed Discover-Tech from its systems following independent third-party checks, stating that it maintains a zero-tolerance policy for malicious ads. Ad provider Vungle paused Discover-Tech’s access while conducting a review, mobile ad platform Eskimi blocked the vendor’s accounts, and IAB Europe confirmed it suspended Discover-Tech from its Global Vendor List after an internal audit [3].
Discover-Tech’s website stayed online and made no mention of the research findings. Russian ad network Yandex and staff for Al Jazeera didn’t respond to requests for comment. Candiru’s owners at Integrity Partners also stayed silent. The firm denied nothing. While dropping Discover-Tech removes one attack route, security analysts caution that contract spyware makers will keep seeking holes in ad systems until digital markets enforce firm customer checks on all buyers [1].
- ONLINE NEWS The Hacker News. (2026, October 15). Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads. The Hacker News. [Article Link]
- ONLINE NEWS Page, C. (2026, October 15). Spyware vendors found a way to make targeted ads even worse. The Register. [Article Link]
- ONLINE NEWS Burgess, M., & Newman, L. H. (2026, October 15). ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads. WIRED. [Article Link]
