Researchers Trace Zero-click Spyware Attacks To Online Ads

Citizen Lab and Confiant say an Israeli advertising firm’s platform enabled spyware attacks through ads, including attacks targeting devices at Al Jazeera.

Security researchers say spyware was delivered through targeted online ads without requiring victims to click or take any other action. In an investigation with ad-security company Confiant, Citizen Lab linked the attacks to Discover-Tech, an Israeli advertising firm, and spyware associated with Candiru. The researchers describe their findings as the first technical confirmation of a zero-click spyware attack delivered through online advertising.

Table of Contents
  1. What the researchers found
  2. How advertising became a delivery route
  3. Responses and implications for tech workers
  4. Sources

What the researchers found

Citizen Lab says Discover-Tech presented itself as an advertising business while operating a platform called Controlium that spyware makers could use to identify particular users and serve them malicious content. TechCrunch reports that the researchers linked both Candiru and another spyware maker, Bindecy, to the platform.

The clearest documented case involves Al Jazeera. The Verge says at least 45 devices at the news organization were targeted in 2024 and 2025. TechCrunch describes at least 45 Windows computers as apparently hacked after exposure to malicious ads. Wired reports that researchers found infected devices contacting domains linked to Discover-Tech and then infrastructure associated with Candiru. Those accounts differ in how they characterize the outcome for all 45 devices: being targeted does not, by itself, establish that each was infected.

Citizen Lab told TechCrunch it could not determine which governments were behind the attacks. Discover-Tech did not respond to requests for comment reported by TechCrunch and Wired.

How advertising became a delivery route

Online ad systems use automated auctions to decide which ad to display to a particular device. According to The Verge, Controlium let users select a target using identifiers such as an IP address, a mobile advertising ID or a browser identifier. TechCrunch reports that exposed portions of Discover-Tech’s website helped researchers examine its dashboard, login records and ad-bidding data.

The potential reach was much broader than the documented Al Jazeera case. Wired says researchers found ads linked to Discover-Tech with attacker script tags across more than 120,000 websites and 70,000 mobile apps between March and June 2026. TechCrunch says bidding records showed ads on devices used by governments, militaries and critical infrastructure organizations, but cautions that a displayed ad does not establish an infection.

Responses and implications for tech workers

Google said it blocked Discover-Tech from its ad platforms after investigating with Citizen Lab and Confiant. Wired reports that advertising company Beeswax also removed the firm, while IAB Europe suspended it from its approved vendor list. Citizen Lab and Confiant called for stronger security across advertising platforms.

For people whose work could make them targets, the findings make ad-delivery systems a security concern, not just a privacy concern. The researchers recommend disabling ad tracking and using ad blockers; The Verge also reports their advice to regularly reset mobile advertising IDs. Those measures are precautions, not evidence that every ad carrying Discover-Tech code caused an infection.

Sources

This story was compiled by AI from the reports below. Read the originals for the full details.