Researchers at the University of Toronto’s Citizen Lab say they have found the first technical evidence of devices being infected with “zero-click” mercenary spyware through targeted online advertising. In a report published on Thursday, 15 October 2026, they say devices at the international news network Al Jazeera were hit this way with spyware made by Candiru.
The findings are Citizen Lab’s. Citizen Lab calls the technique “AdFection.”
What Citizen Lab found
The report describes itself as “the first-ever technical demonstration of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements.”
“We find with high confidence that devices at international media network Al Jazeera were targeted and infected with Candiru’s mercenary spyware using AdFection,” the lab says.
According to the report, at least 45 devices within Al Jazeera were targeted in a series of zero-click attacks in 2024 and 2025. “Zero-click” means the victim does not have to open a message or click a link for the device to be infected.
The lab says network logs provided by Al Jazeera showed a clear pattern: infected devices first contacted servers linked to an ad company, then a Candiru server that checked the device, before being further profiled and infected.
The company at the centre
At the heart of the report is Discover-Tech, which Citizen Lab describes as an Israel-based company that “presents itself as a legitimate online advertising business.” Citizen Lab says it is in fact a bridge between mercenary spyware firms and the advertising industry, and that it found “no evidence that Discover-Tech was engaged in legitimate advertising activity.”
Discover-Tech operates a platform called Controlium, which the lab calls “a one-stop platform for mercenary spyware firms to infect targets via online ads.” According to the report, Controlium’s users include Candiru, which is “reportedly now owned by US-based Integrity Labs.” Citizen Lab also links the platform to Bindecy, an Israel-based firm specialising in zero-click mobile exploits, and to another surveillance company called Intelos.
Candiru was added to the US Commerce Department’s Entity List for developing spyware used against “government officials, journalists, businesspeople, activists, academics, and embassy workers,” Citizen Lab notes.
How it works, in plain terms
Online ads are usually sold in split-second auctions that share information about the person and device about to see them. Citizen Lab says Discover-Tech used this system to profile users. When someone saw one of its seemingly harmless ads, their ad identifier and IP address were sent to Discover-Tech’s servers. If that person was selected for hacking, the device was sent malicious code that exploited and infected it.
Because the ads themselves did not contain the exploit code, the lab says, the platforms delivering them could not easily see their real purpose.
The scale, and an important caveat
Citizen Lab says it analysed billions of ad bidding records and found that Discover-Tech’s ads “directed millions of devices across dozens of countries to contact their profiling and infection servers.” It says the ads appeared on devices on national-security-sensitive networks, including NATO, the United Nations, the European Parliament, the European Commission and the Council of the EU’s General Secretariat.
But the lab is clear about the limits: “A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware.” It says such impressions would at minimum have led to profiling, and calls for urgent investigation. Its view of Discover-Tech’s activity is also incomplete: the data comes from one of the company’s platforms and covers a limited period.
It is not clear which governments were behind the attacks, TechCrunch reported Citizen Lab as saying.
Industry response
Citizen Lab says that as a result of its investigation, Google and IAB Europe, the advertising industry body, removed Discover-Tech from their ad vendor lists, and Google and Beeswax cut off its access to their ad systems. Vungle (Liftoff) paused the company’s access while it reviews it, and Eskimi blocked its accounts and domains, the report says.
No comment from the companies
Discover-Tech did not respond to Citizen Lab’s request for comment within its deadline, and neither did Candiru/Integrity Labs, Bindecy or Intelos, according to the report. TechCrunch reported that Discover-Tech and Al Jazeera did not respond to its requests for comment, and that Integrity Labs could not be reached.
What researchers advise
Bill Marczak, a senior researcher at Citizen Lab, told TechCrunch: “If you might be targeted based on who you are or what you do, it’s time to disable ad tracking on your devices or even block ads altogether.” He called Discover-Tech “surely just the tip of the iceberg.”
What this means
- Ads as a delivery route. Citizen Lab says it has shown spyware being delivered through ordinary targeted advertising, without a click.
- Wide exposure, unclear infection. Ads reached sensitive networks, but an ad impression alone doesn’t prove anyone was infected.
- Higher-risk users can act. Citizen Lab advises turning off ad tracking or blocking ads.
Sources
- Citizen Lab, “How Discover-Tech turned targeted ads into a pipeline for spyware”, 15 October 2026. https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
- Citizen Lab, “Exposing AdFection: Executive Summary”, 15 October 2026. https://citizenlab.ca/research/exposing-adfection-executive-summary/
- TechCrunch, “Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware”, 15 October 2026. https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/
