Cybersecurity researchers at The Citizen Lab at the University of Toronto, working alongside the U.S. ad-security firm Confiant, have uncovered the first publicly confirmed technical case of “zero-click” mercenary spyware delivered through targeted online advertisements. Disclosed on October 15, 2026, the operation—dubbed “AdFection”—involved an Israeli-registered digital advertising agency called Discover-Tech, which served as a facilitator for surveillance vendors. During 2024 and 2025, the campaign targeted at least 45 devices belonging to staff at the news network Al Jazeera, quietly redirecting selected targets to exploit servers linked with high confidence to the Israeli spyware developer Candiru.

Unlike traditional phishing or malvertising schemes that require a victim to click a link or download a malicious file, zero-click attacks execute automatically. Simply loading a web page or opening a mobile app displaying an ad was enough to initiate the infection chain in a matter of seconds. According to WIRED, Citizen Lab senior researcher Bill Marczak noted that victims targeted in this manner would see nothing unusual, and in some cases might not even see a visible ad at all.

How Programmatic Advertising Was Weaponized

The AdFection technique exploits two core components of the modern digital advertising architecture: individual-level microtargeting via Real-Time Bidding (RTB) and the ability for third parties to run executable code inside browsers and mobile apps. Every time a user opens an ad-supported website or application, a Supply-Side Platform (SSP) collects granular device characteristics, IP addresses, precise locations, and mobile advertising IDs, sending them to ad exchanges that host billions of auctions daily. Advertisers use Demand-Side Platforms (DSPs) to bid on those specific impressions in less than a second.

According to the Guardian, Discover-Tech operated a software platform called Controlium that allowed clients to mass-profile and deanonymize internet users through seemingly benign custom ads, such as promotions for digital games or telecommunications services. When an ordinary-looking ad loaded, embedded tracking tags and JavaScript transmitted device and identity parameters back to Discover-Tech infrastructure. In some instances, according to Reuters, the ads also attempted to extract phone numbers from smartphone users.

If the system identified a device as a pre-selected target, the ad served additional JavaScript to fingerprint the hardware and silently redirected the browser or app to an external server housing spyware exploits. Once installed, the spyware could access messages, photos, and emails, record phone calls, and secretly activate microphones.

Executing code inside an ad slot does not automatically grant full device control. Cybersecurity analyst Eddy Willems told Al Jazeera that an attacker must chain multiple vulnerabilities to escape the browser’s isolated “sandbox” environment and bypass operating system security boundaries.

Scale of Exposure Versus Confirmed Targets

To map the network, researchers examined nearly four billion ad-bidding records between March and June 2026, according to The Register and Reuters. The data showed that Discover-Tech had appeared on approved advertising vendor lists since 2020, allowing its ads to reach more than 120,000 websites and 75,000 apps globally—figures that some coverage summarizes as nearly 200,000 combined sites and apps. Through its partnerships, Discover-Tech gained access to major advertising platforms operated by Google, Comcast, and Yandex.

Researchers found that Discover-Tech ads were served to millions of users across Yemen, Brazil, Mexico, and Czechia, as well as on networks used by government entities in the United States and Europe, the United Nations, NATO, the International Criminal Court, and the International Atomic Energy Agency.

However, security researchers emphasize a critical distinction between ad exposure and actual spyware infection. While some outlets describe the 45 Al Jazeera devices as “infected” or “compromised,” Citizen Lab and NBC News specifically note that at least 45 devices were targeted during 2024 and 2025 after Al Jazeera’s internal technology team spotted unusual network patterns in 2024. Furthermore, Reuters reports that Confiant found Candiru-linked ads represented only a tiny fraction of Discover-Tech’s overall advertising volume. Encountering an ad from the agency indicates potential profiling or exposure, rather than a confirmed device compromise.

Industry Response and U.S. Regulatory Context

The disclosure prompted immediate enforcement actions across the ad-tech sector, though reports detail different protective measures across platforms. According to Reuters, Google blocked Discover-Tech from its advertising platforms following the joint investigation, citing systematic policy violations. Meanwhile, CBC reports that Google also configured Safe Browsing warnings for users navigating to websites linked to the group, while specialist coverage notes that IAB Europe suspended Discover-Tech from its approved vendor registry.

For U.S. regulators, the findings highlight how commercial ad networks can be used to bypass national security restrictions. Candiru was placed on the U.S. Commerce Department Entity List in 2021 after Citizen Lab linked the company to the hacking of at least 100 journalists, human rights defenders, and political activists across 10 countries. By routing attacks through an intermediary ad agency, surveillance operators were able to utilize U.S.-based ad infrastructure despite existing export controls. While researchers have urged cybersecurity agencies and regulators in the United States, Canada, and Europe to address systemic abuses in real-time bidding, according to BetaKit, no specific U.S. government enforcement action against Discover-Tech had been announced at the time of disclosure.

What It Means for Readers and High-Risk Users

Citizen Lab researcher Wolfie Christl described the abuse of the online advertising ecosystem as a severe security threat for government agencies, private enterprises, and civil society alike. Because the attacks require no user interaction, traditional anti-phishing training cannot prevent them.

Can ordinary users detect an attack after an ad loads, and what protections exist?

An ordinary user cannot visually detect an AdFection attack, as the malicious JavaScript executes silently in the background without displaying anomalous pop-ups. Because zero-click exploits rely on unpatched software vulnerabilities to escape the browser sandbox, keeping operating systems, web browsers, and mobile apps updated is the primary technical defense against exploit chains. Additionally, Bill Marczak noted to WIRED that blocking ads thoroughly across websites and platforms is one of the few practical steps individuals can take to cut off the delivery vector—a practice already recommended by intelligence agencies such as the NSA and CIA. High-risk individuals, such as journalists and embassy workers, must rely on network log analysis and specialized forensic checks to identify indicators of compromise.

Did every person who saw a Discover-Tech ad get hacked with spyware?

No. While Discover-Tech distributed ads across more than 120,000 websites and 75,000 apps, the exploit chain was highly selective. The vast majority of impressions simply functioned as ordinary advertisements or collected device identifiers, with zero-click spyware payloads reserved for specific, pre-selected targets.

Sources

Read More