Pull to refresh
Logo
What Changed
Following Why Sign Up
Researchers confirm zero-click spyware delivered through targeted ads

Researchers confirm zero-click spyware delivered through targeted ads

New Capabilities

Citizen Lab finds Israeli ad firm Discover-Tech infected Al Jazeera devices with Candiru spyware through ordinary ads

October 15th, 2026: AdFection reports published

Overview

Updated Oct 20

Citizen Lab has documented the first confirmed case of spyware installed through an online ad, with no click required. The technique, which the lab calls AdFection, let Israeli ad firm Discover-Tech infect 45 Al Jazeera devices with Candiru spyware in 2024 and 2025 by showing ordinary-looking ads.

The Oct. 15 report also found Discover-Tech ads on the networks of defense ministries, national cyber agencies, NATO and critical infrastructure; ABC News reported the ads reached Australia's nuclear agency. Google, IAB Europe and Comcast's ad subsidiary Beeswax have since cut the company off. Canada's privacy commissioner is examining the report, and the Committee to Protect Journalists has called for a full investigation.

Why it matters

The global ad system touches billions of devices daily; turning it into a spyware channel means loading a webpage could infect any phone or computer.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

3.77B
Ad bids placed in four months
Discover-Tech placed 3.77 billion ad bids between March and June 2026, per Citizen Lab.
442M
Ad auctions won
Discover-Tech won 442 million auctions in the same March to June 2026 window.
45
Al Jazeera devices infected
Devices at the news network infected with Candiru spyware delivered through ads in 2024 and 2025.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Bill Marczak
Bill Marczak
Senior researcher, Citizen Lab
Lead researcher on the AdFection investigation
 Ron Deibert
Ron Deibert
Director, Citizen Lab
Oversaw the investigation
 Jerome Dangu
Jerome Dangu
Cofounder, Confiant
Co-published the AdFection investigation

Organizations Involved

Citizen Lab
Citizen Lab
Research unit
Documented the AdFection campaign

Digital investigations research unit at the University of Toronto that tracks surveillance technology and cyber espionage.
DT
Discover-Tech
Advertising firm
Cut off from Google, IAB Europe and Beeswax ad systems

Israel-based digital advertising agency that operates the Controlium spyware delivery platform.
CA
Candiru
Mercenary spyware firm
Blacklisted by US Commerce Department; linked to Al Jazeera infections

Israel-based spyware developer that rebranded as Integrity Labs.
Confiant
Confiant
Advertising security firm
Co-published the AdFection investigation

New York-based firm that monitors the digital ad supply chain for malicious activity.
Al Jazeera
Al Jazeera
News network
Victim of the attack; 45 devices infected

International news network headquartered in Doha, Qatar.

Timeline

November 2021 October 2026

5 events Latest: October 15th, 2026 · 4 weeks ago
Tap a bar to jump to that date

  1. AdFection reports published

    Latest Disclosure

    Citizen Lab and Confiant release the first public confirmation that targeted ads installed mercenary spyware with no click. The report found Discover-Tech ads on the networks of defense ministries, national cyber agencies, NATO and critical infrastructure, including Australia's nuclear agency as reported by ABC News.

  2. CPJ calls for investigation into Al Jazeera spyware attacks

    Policy

    The Committee to Protect Journalists urged Israeli and other authorities to investigate and hold accountable those behind the spyware infections at Al Jazeera.

  3. Google and IAB Europe drop Discover-Tech

    Regulatory

    Google terminates Discover-Tech's ad access; IAB Europe suspends its certified vendor status after an audit.

  4. Al Jazeera infections begin

    Incident

    45 Al Jazeera devices infected with Candiru spyware delivered through Discover-Tech ads.

  5. US blacklists Candiru

    Regulatory

    Commerce Department adds Candiru to the Entity List for developing spyware targeting officials and journalists.

Scenarios

1

Discover-Tech faces legal action or shuts down

Possible Resolves by End of 2027

Discussed by: Reuters, WIRED, security researchers

Regulators, affected companies, or victims file lawsuits against Discover-Tech or named executives for facilitating spyware infections. This could also include criminal charges in countries where the affected networks are based. The company has already lost access to Google's ad systems and its IAB Europe certification, which may undermine its business model.

2

Ad-delivered spyware spreads to other vendors

Likely Resolves by End of 2027

Discussed by: Citizen Lab, Confiant, Ars Technica

Other mercenary spyware firms adopt the AdFection technique, using ad networks to profile and infect targets. Confiant noted that Candiru-linked ads were a tiny fraction of Discover-Tech's volume, suggesting the platform served multiple spyware clients. A second documented case would confirm the technique is becoming a standard delivery method.

3

Ad-tech industry tightens vendor vetting

Possible Resolves by Q2 2027

Discussed by: Google, IAB Europe statements

Google and IAB Europe introduce permanent certification or audit requirements that screen ad vendors for connections to surveillance and spyware activity. Both organizations have already taken preliminary action against Discover-Tech. Durable reforms would make it harder for similar firms to operate through certified ad networks.

4

Israel or other regulators open formal investigations into Discover-Tech

Possible Resolves by Q1 2027

Discussed by: Committee to Protect Journalists, Reuters, Citizen Lab

The Committee to Protect Journalists called on Israeli and other authorities to investigate and hold accountable those responsible for the Al Jazeera infections. A formal probe could reveal how Discover-Tech's Controlium platform enabled spyware delivery and whether executives knew about the attacks.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

July 2021

Pegasus Project (2021)

A consortium of 17 media organizations revealed that NSO Group's Pegasus spyware had been used to hack phones of journalists, human rights lawyers, and heads of state in multiple countries. The investigation, based on a leaked list of 50,000 phone numbers, exposed the scale of commercial spyware abuse.

Then

Governments and the European Parliament opened inquiries; Apple filed a lawsuit against NSO Group.

Now

The US Commerce Department added NSO and Candiru to its Entity List in November 2021, restricting their access to US technology.

Why this matters now

The Pegasus Project established the pattern of mercenary spyware being used against journalists and activists. AdFection shows the same firms finding a new delivery channel through the commercial ad ecosystem.

June 2023

Operation Triangulation (2023)

Kaspersky researchers discovered an iOS exploit chain that infected iPhones with zero user interaction, delivered through malicious iMessage attachments. The spyware, called TriangleDB, exfiltrated data and could record audio and track location.

Then

Apple issued patches for the four vulnerabilities; Kaspersky identified the spyware as targeting its own employees and other respondents.

Now

It demonstrated that zero-click exploits work in the wild against modern smartphones.

Why this matters now

Operation Triangulation proved zero-click infection was technically possible at scale. AdFection is the first confirmed case of the same technique being delivered through the online advertising pipeline.

Sources

(16)
+10
Citizen Lab Slashdot Ars Technica TechCrunch WIRED The Verge Reuters via Investing.com CBC News Al Jazeera Financial Times Committee to Protect Journalists BleepingComputer NBC News ABC News Dark Reading Al Jazeera