Citizen Lab says spyware rode in on online ads, no click needed

The researchers call the method AdFection. They say it is the first public technical confirmation of a zero-click spyware attack delivered through targeted advertising.

A zero-click attack needs nothing from the victim. No link to tap, no file to open. The device gets infected while the person is just reading a page or using an app.

The ads were bought by Discover-Tech, an Israeli company founded in 2020. Citizen Lab says it presents itself as a normal ad business but in practice works as "a bridge between ad vendors and the mercenary spyware ecosystem."

"There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," Citizen Lab senior researcher Bill Marczak told TechCrunch.

The clearest case is Al Jazeera. Citizen Lab says at least 45 Windows computers at the broadcaster were infected with spyware from Candiru in 2024 and 2025, after they were shown ads loaded with malicious code.

According to Reuters, the researchers could confirm this because Al Jazeera shared its network logs with them. Al Jazeera did not respond to requests for comment from Reuters or TechCrunch.

Candiru, which Citizen Lab says has been rebranded as Integrity Labs, is no stranger to these reports. The US Commerce Department blacklisted it in 2021 for allegedly supplying spyware used against government officials, journalists, activists and academics, Reuters notes.

TechCrunch reports it is not clear which governments were behind the attacks.

Most of us think of an ad as a picture or a short video. But an online ad can also carry code that runs inside your browser or app while the ad is on screen. That is how ads count views and clicks.

Every time you open a page, a tiny auction happens in under a second. Your device sends out details about itself, advertisers bid, and the winner's ad appears. Citizen Lab says these auctions run hundreds of billions of times a day, and they can be aimed at a single person using an ad ID, a cookie or an IP address.

Here is the chain Citizen Lab describes:

• The bid: Discover-Tech wins an ad slot on a website or app, often with an ad for something ordinary, like phones or earbuds, according to Reuters.
• The call home: a small script in the ad contacts a Discover-Tech server and sends the user's ad identifiers.
• The decision: the server checks the IP address and identifiers. If you are not a target, it sends back nothing at all.
• The payload: if you are a target, it sends back code, which can load more code, including an exploit that installs spyware.

In real life Think of a flyer slipped under every door in a building. For almost everyone, it is just paper. For one chosen apartment, the same flyer quietly unlocks the door.

Why it matters: because the server only sends harmful code to chosen targets, the big ad networks showing the ad never see anything malicious. Citizen Lab says that was the point of the design.

Controlium is the Discover-Tech platform at the center of the report. Citizen Lab describes it as a control panel that lets spyware customers profile people, fingerprint their devices and push "controlled ads" to specific users.

TechCrunch reports the researchers got a surprisingly clear look inside. Some of Controlium's source code was exposed on its login pages, so they could rebuild the dashboard without logging in.

They also found downloadable login records for the platform. Those included logins from at least two Candiru employees and some from Bindecy, another spyware maker, according to TechCrunch.

Citizen Lab also links Discover-Tech to Intelos, a firm that sells intelligence gathered from ad data. And it flags a separate actor it calls DARK CARTOGRAPHER, which it says used Discover-Tech's setup to link phone ad IDs to real phone numbers across mobile carriers. A separate report on that is coming.

Bigger than one newsroom. A Discover-Tech server left almost 4 billion ad bidding records exposed.

By the numbers:

• Almost 200,000: unique websites and Android and iOS apps that showed Discover-Tech ads over four months, according to Citizen Lab. Reuters breaks that down as more than 120,000 websites and 75,000 apps.
• March to June 2026: the period those records cover, per TechCrunch.
• 10 million a day: the minimum number of ads Discover-Tech was pushing out worldwide, according to Jerome Dangu, cofounder of the ad security firm Confiant, which ran its own investigation.
• Hundreds of millions: the number of people Dangu told Reuters were "very likely" touched by Discover-Tech's tracking.

The ads also appeared on devices inside militaries, governments, critical infrastructure and national cyber agencies. Confiant says it saw likely malicious ads on networks of the International Atomic Energy Agency and the International Criminal Court, and Reuters adds the Pentagon to that list.

The catch: seeing an ad is not the same as being hacked. TechCrunch notes it is unclear whether those ads led to any infections. Confiant also told Reuters the ads tied to Candiru were a tiny fraction of Discover-Tech's total.

Through the front door. Citizen Lab says Discover-Tech appeared on "certified" and "approved" vendor lists kept by Google and the industry group IAB Europe from 2020 until 2026.

It bought ads through major systems, including Google, Yandex, Vungle (owned by Liftoff), Sunteng, Eskimi and Comcast's Beeswax. The report also describes data swaps with Microsoft's Xandr ad system.

Citizen Lab argues the online ad system itself failed to detect or stop the abuse for years.

"It's still disastrous that major ad vendors and organizations apparently were neither able to detect nor prevent this company's malicious advertising operations for several years," report co-author Wolfie Christl told The Globe and Mail.

Citizen Lab says it contacted 13 companies before publishing. Several acted:

• Google: removed Discover-Tech from its vendor list and cut its access to Google's ad exchanges. Google worked with the researchers on the investigation.
• IAB Europe: removed the company from its registry in early October 2026.
• Beeswax: removed Discover-Tech from its ad buying platform.
• Vungle (Liftoff): paused its access while it reviews the case.
• Eskimi: blocked Discover-Tech's accounts and domains.

Other vendors did not reply in time, the report says. Discover-Tech did not respond to Reuters or TechCrunch, and TechCrunch could not reach Candiru's owner, Integrity Labs.

What's next: Citizen Lab is calling on regulators to investigate whether Discover-Tech and Candiru broke any laws. Marczak told TechCrunch that Discover-Tech is "surely just the tip of the iceberg." For another way malicious code reaches people through familiar tools, see our story on hackers spreading malware through custom ChatGPT bots, and our Google coverage.

• Most people were not targeted: the spyware only went to chosen devices. For everyone else, the ads mainly collected data like an IP address.
• Turn off ad tracking: on iPhone and Android you can limit or reset your ad ID in privacy settings. Marczak says people who might be targeted should do this now.
• Consider an ad blocker: Marczak also suggests blocking ads altogether if your job or identity could make you a target, such as journalists or activists.
• Keep everything updated: spyware usually needs a browser or system bug to get in, and updates close those holes.