Zero-Click Spyware Delivered Through Online Ads Confirmed in First Known Cases

Mobile devices face a new infection route that requires no action from the user. Researchers at Citizen Lab documented cases in which mercenary spyware reached targets through ordinary online advertisements served by global ad networks.

The University of Toronto group traced the activity to an Israeli firm, Discover-Tech, that operated an advertising platform called Controlium. The platform allowed clients to select specific devices or users and deliver malicious code alongside or instead of standard ads. Two spyware vendors, Candiru and Bindecy, used the service, according to the report released October 15, 2026. The attacks are described as zero-click because the malware installs without the target opening a message or clicking a link.

One confirmed campaign reached at least 45 Windows computers belonging to Al Jazeera journalists and staff during 2024 and 2025. Network logs showed the devices contacted domains linked to Discover-Tech and then to servers associated with Candiru. Al Jazeera shared device data with the researchers but has not commented publicly. Citizen Lab could not determine which governments directed the attacks.

The researchers gained access to Discover-Tech’s exposed source code and login records. They recovered employee credentials belonging to Candiru and Bindecy staff and downloaded billions of ad-bidding records. Those records showed the firm’s ads appeared across more than 70,000 mobile apps and 120,000 websites between March and June 2026. Some impressions reached networks belonging to militaries, governments, and critical infrastructure operators, though it remains unverified whether those impressions led to infections.

Google terminated Discover-Tech’s accounts after its own review with Citizen Lab and the firm Confiant. The Interactive Advertising Bureau Europe suspended the company from its vendor list. Beeswax, an ad platform owned by Comcast, also removed the firm. Discover-Tech, Candiru’s owner Integrity Labs, and Al Jazeera did not respond to requests for comment.

Citizen Lab senior researcher Bill Marczak said the case demonstrates how real-time bidding systems can be repurposed for precise targeting. He advised users who may be at risk to disable ad tracking or install comprehensive ad blockers. The report notes that similar abuse of ad infrastructure has been discussed for years but lacked public technical confirmation until now.