Security researchers say government spyware makers have been hijacking online advertising to slip spyware onto phones and computers — no click required.
A report published on Thursday by the University of Toronto’s Citizen Lab, which investigates digital surveillance, names an Israeli advertising firm, Discover-Tech, as the link between the global ad market and the mercenary spyware industry. The lab calls the technique “AdFection” and describes it as the first confirmed case of government-grade zero-click spyware delivered through targeted ads.
Zero-click spyware can infect a device without the victim opening a message or tapping a link. In this case, the malicious code arrived inside ordinary-looking adverts: when the ad loaded, it could fingerprint the device and trigger a silent infection on chosen targets.
The researchers tie at least two spyware makers to Discover-Tech’s platform, which the firm calls Controlium. One is Candiru — now operating as Integrity Labs — which the United States placed on its trade blacklist in 2021. Bindecy was another; a third surveillance company, Intelos, was also linked. The lab says it is not clear which governments were behind the attacks.
Al Jazeera devices among the targets
The investigation reconstructs a real operation, not a theoretical one. Network logs showed at least 45 Windows computers at the broadcaster Al Jazeera were targeted in 2024 and 2025, with the researchers linking the attacks to Candiru’s spyware delivered through Discover-Tech’s adverts with high confidence.
The scale of the ad operation was vast. Discover-Tech’s own exposed bidding records show it bid on nearly 3.8 billion ad impressions between March and June 2026 and won about 442 million, with its adverts appearing across more than 120,000 websites and 70,000 mobile apps. Its ads were displayed on devices used by militaries, governments, critical infrastructure operators and national cyber agencies — though the researchers stress that seeing an ad is not proof a device was infected.
Platforms cut ties as fallout spreads
Since the findings landed, Google has terminated Discover-Tech’s access to its advertising exchanges, an industry body suspended the firm’s vendor status, and several ad platforms have blocked or paused its accounts. The episode shows how ad infrastructure built to sell products can be repurposed for espionage — a concern that has grown alongside other recent AI-security scares, from an Anthropic model filing a false homicide tip with Philadelphia police to researchers racing to fine-tune AI models for fraud detection.
The researchers say Discover-Tech is likely just the tip of the iceberg, and urge anyone who might be a target to switch off ad tracking or block ads altogether. United States security agencies have given similar advice for years: both the NSA and the federal cyber agency CISA have long recommended ad-blocking software against such attacks.
