Researchers find online ads used to deliver zero-click spyware

Researchers at the University of Toronto’s Citizen Lab have identified a method by which online advertisements were used to deliver "zero-click" spyware to millions of devices. The investigation, published on October 15, 2026, alleges that the Israeli advertising agency Discover-Tech operated a platform that allowed clients to profile users and facilitate covert infections without requiring any interaction from the victim.

The AdFection Technique

The researchers named the technique "AdFection." According to Citizen Lab, Discover-Tech operates a software platform called Controlium, which allows clients to "mass-profile and deanonymise" internet users. The platform then enables third-party spyware firms to target specific individuals. Unlike traditional malware that requires a user to click a link or download a file, this method installs spyware automatically when a user is served a seemingly benign advertisement.

Bill Marczak, a senior researcher at Citizen Lab, stated, "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action."

The infections allegedly rely on the real-time bidding system used by major ad platforms. When a user visits a website, their device details are entered into an automated auction. If the user is selected as a target, malicious code is sent to their device via the ad slot. Citizen Lab says the spyware can access messages, photos, and emails, record calls, and activate microphones.

Scale and Targets

An analysis of four billion advertising records revealed that Discover-Tech’s ads appeared on nearly 200,000 websites and mobile apps across dozens of countries over a four-month period. The ads were served to users in Yemen, Brazil, Mexico, and Czechia, among other locations.

The investigation found that 45 devices belonging to journalists and staff at the Qatari broadcaster Al Jazeera were targeted, with some infected by spyware known as Candiru. Candiru was acquired by Integrity Labs in 2025. Discover-Tech and Integrity Labs did not immediately respond to requests for comment.

Related work by the cybersecurity firm Confiant indicated that Discover-Tech’s ads reached networks associated with government entities in Europe and the US, as well as the United Nations, NATO, the International Criminal Court, and the International Atomic Energy Agency.

Industry Response and Calls for Regulation

Following the disclosures, several major advertising vendors, including Google, IAB Europe, Beeswax, Vungle, and Eskimi, disconnected Discover-Tech from their systems, according to the report.

Wolfie Christl, a researcher at Citizen Lab, criticized the lack of oversight in the digital advertising market. "It’s disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company’s malicious advertising operations for years," Christl said. "The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike."

Hannah Neumann, a German European Parliament lawmaker, called for urgent action. "The possibility that EU institutions have been exposed should set off alarm bells across Brussels," Neumann said. "Europe cannot claim to defend democracy while leaving its own democratic institutions vulnerable to spyware."

Why it matters

This report highlights a significant vulnerability in the global digital advertising infrastructure. By exploiting the automated nature of ad delivery, malicious actors can bypass traditional security measures that rely on user caution. The exposure of high-profile institutions, including NATO and the European Parliament, underscores the potential for state-level espionage and the urgent need for stricter regulation and security protocols in the ad tech industry.

---

Sources

• theguardian.com: Online ads weaponised to deliver ‘zero-click’ spyware, researchers say | Hacking | The Guardian
• politico.eu: Millions of phones exposed to Israeli spyware operation through online ads, researchers say – POLITICO
• suaragarut.id: Researchers Expose Spyware Attacks Through Online Ads

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.