Cybersecurity investigators have uncovered the first confirmed instances of zero-click mercenary spyware distributed through targeted digital advertisements, revealing a sophisticated pipeline that infected dozens of devices belonging to journalists and international organizations.
A joint probe published Thursday by the Citizen Lab, a research group at the University of Toronto, and advertising security firm Confiant revealed that Israeli digital advertising firm Discover-Tech leveraged real-time bidding ad exchanges to silently compromise target devices. The researchers discovered that Discover-Tech acted as a conduit between commercial ad vendors and mercenary surveillance companies, notably Candiru, an Israeli spyware vendor placed on a U.S. government blacklist in 2021.
How silent ad infection works
The campaign, dubbed “AdFection” by the researchers, exploits the complex programmatic auction system that displays digital advertisements in mobile applications and web browsers hundreds of billions of times each day. When an ad auction takes place, granular device identifiers, location records and IP addresses are shared with potential bidders.
Discover-Tech purchased ad slots that delivered custom-tailored ads to targeted individuals, Citizen Lab reported. When an ad rendered on a targeted screen or in the background, embedded code contacted a Discover-Tech server. If the server confirmed that the device matched an intended surveillance target, it transmitted malicious JavaScript that deployed zero-click exploits to install Candiru’s spyware within seconds, requiring no user clicks or interaction.
“There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” Citizen Lab researcher Bill Marczak said in the report.
The installed malware is capable of extracting documents, browser cookies, saved passwords, chat messages and emails. It can also capture keystrokes, take screenshots and secretly activate a device’s microphone and camera while breaking data into small, encrypted batches to evade network security defenses.
Global reach and institutional targets
Citizen Lab reported that it believes at least 45 devices belonging to employees at international broadcaster Al Jazeera were targeted, and some infected, using the technique. Al Jazeera’s technical personnel first flagged abnormal network traffic on staff phones in 2024 and 2025 before asking Citizen Lab to conduct a forensic review.
Al Jazeera condemned the cyberattacks on Thursday, calling the surveillance an assault on press freedom and demanding accountability for those responsible.
Analysis of roughly four billion Discover-Tech ad bidding logs indicated that the company’s ads were served across nearly 200,000 Android apps, Apple iOS apps and websites, reaching millions of users in countries including Brazil, the Czech Republic, Mexico and Yemen. Confiant’s parallel investigation showed that Discover-Tech ads also registered impressions on sensitive networks used by the Pentagon, NATO, the International Criminal Court and the United Nations International Atomic Energy Agency.
“The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike,” said Wolfie Christl, a Citizen Lab researcher.
Industry response and next steps
Following notifications from Citizen Lab, several major advertising platforms took steps to sever ties with Discover-Tech in early October 2026. Tech firms acted against the company’s accounts and domains:
- Google removed Discover-Tech from its certified vendor lists and closed its access to Google ad exchanges.
- IAB Europe stripped Discover-Tech from its approved advertising industry registry.
- Ad-buying platforms Beeswax and Eskimi disabled or blocked Discover-Tech’s access and accounts.
- Ad network Vungle, owned by Liftoff, paused Discover-Tech’s access pending an internal review.
Researchers noted that the full scope of individuals hacked through Discover-Tech’s Controlium platform remains unknown. While major ad vendors have moved to shut down Discover-Tech’s infrastructure, researchers warned that systemic vulnerabilities in real-time ad bidding continue to leave mobile devices vulnerable to commercial surveillance until regulatory or architectural reforms are enacted.
