Online Ads Delivered Spyware With No Click, Researchers Say

October 15, 2026

TECH & AI

An ordinary ad can hand a device to a spyware operator before the person even notices it is there. That is what researchers at the Citizen Lab describe in a report published Thursday. They say it happened to devices at Al Jazeera, and they call it the first public confirmation of spyware delivered through targeted ads with no click required.

At least 45 Al Jazeera devices were targeted in 2024 and 2025. The researchers link the attacks with high confidence to Candiru, the Israeli spyware maker that has since rebranded as Integrity Labs. The evidence sits in network logs from Al Jazeera that show the same quiet sequence each time: a device contacts an ad company’s server, then a Candiru server that checks it, then a Candiru control server.

How an ad becomes an attack

The ad loads and reaches a server run by an Israeli company called Discover-Tech. It passes along the device’s advertising ID. The server decides whether that device is a target. Most people who see the ad get nothing back. A device that is picked receives code that starts the infection, and the person does not have to click anything. That selection step also keeps the malicious code away from the ad companies that display the ads, which makes it harder for them to notice.

The company in the middle

Discover-Tech presents itself as an ordinary advertising company. The Citizen Lab says it works as a bridge between the ad industry and spyware vendors. Its platform, called Controlium, lets customers pick out specific devices and target them through ads. The report links the company to Candiru, Bindecy and Intelos, all of which it places in the spyware and surveillance industry. Discover-Tech was registered in Israel in 2020, and Google and IAB Europe listed it as an approved ad vendor from 2020 to 2026.

How far the ads reached

The researchers reviewed almost four billion ad bidding records from March through June 2026. They found Discover-Tech’s code in ads on about 75,000 apps and 121,000 websites, and found that the ads sent millions of devices to Candiru servers.

Ad impressions also appeared on networks run by governments in 24 countries. The report stresses that an impression does not by itself confirm targeting or infection. Confiant, an ad security firm that worked with the researchers, found signs that ads were shown on networks used by the U.S. Department of Defense and several European government bodies, and the report presents that as Confiant’s finding.

What the ad industry did

After the researchers disclosed what they found, Google removed Discover-Tech from its vendor registries and ended its access to Google’s ad platforms. IAB Europe, an industry group, dropped it from its vendor list. Beeswax removed it from its ad-buying platform, Vungle paused its access during a review, and Eskimi blocked its accounts and domains. Discover-Tech, Candiru, Bindecy and Intelos did not respond to the researchers’ requests for comment.

What is still unknown

The report does not name any government as a customer, and the researchers say they cannot yet attribute the attacks to a specific party. The one malware sample recovered from a compromised device was a Windows file. Discover-Tech ads also ran in Android apps, but the report does not link those to infections.

Bill Marczak, one of the researchers, called Discover-Tech “surely just the tip of the iceberg.” He advised people who might be targeted to turn off ad tracking or block ads altogether. Most people who see these ads are not selected, since the server returns nothing to devices it does not pick.

This article is based on the Citizen Lab report published Thursday, with additional details from contemporaneous coverage.

Sources:

The Citizen Lab (University of Toronto): Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (Oct. 15, 2026)

TechCrunch: Citizen Lab says governments are abusing online ads to hack people with 'zero-click' spyware (Oct. 15, 2026)

CyberScoop: AdFection: How mercenary spyware invades victims' devices through targeted advertising (Oct. 15, 2026)