Zero-Click Spyware Delivered Through Online Ads Confirmed in First Known Cases

Citizen Lab researchers at the University of Toronto have documented how state-backed operators are routing zero-click spyware through commercial advertising networks. The report details the activities of an Israeli firm called Discover-Tech, which functions as an intermediary linking ad vendors to mercenary spyware developers. At least two such developers, Candiru and Bindecy, have used the platform to deliver infections that require no action from the target.

The mechanism, labeled AdFection in the study, allows operators to select specific individuals or devices and serve malicious code embedded in ordinary online advertisements. Once delivered, the spyware can extract data without the user noticing any unusual activity or even seeing the ad. Researchers traced one campaign that compromised at least 45 Windows computers at the media organization Al Jazeera during 2024 and 2025. The infections were attributed to Candiru tools and arrived through ad exposures rather than email links or messaging apps.

Citizen Lab notes that this marks the first public technical confirmation of zero-click government spyware arriving via the advertising supply chain. The approach expands the attack surface dramatically because digital ads reach users across apps and websites worldwide. Victims browsing routine content can be singled out and compromised with little visible trace. Bill Marczak, a senior researcher at the lab, observed that targets would detect nothing amiss and might not encounter any ad at all.

The underlying pattern aligns with long-standing concerns over concentrated state power. When governments contract with specialized firms to acquire tools that bypass ordinary user behavior, the result is expanded surveillance capacity that operates outside traditional legal safeguards. Discover-Tech presents itself as a standard advertising service, yet its role in connecting clients to spyware operators illustrates how commercial infrastructure can be repurposed for covert ends. Past disclosures have shown similar patterns with other vendors, but the ad-delivery vector adds scale and deniability.

Details on the sponsoring governments remain limited in the report. The researchers could not attribute specific clients, though the involvement of companies such as Candiru, which have faced prior scrutiny for sales to state actors, points to official demand. The Al Jazeera incident underscores risks to independent reporting when surveillance tools can reach devices used by journalists without requiring phishing success or user error.

Market incentives play a role here as well. Advertising networks optimize for reach and precision targeting, features that surveillance operators can exploit once access is purchased. Attempts to regulate such flows often produce compliance costs that smaller participants absorb while determined state buyers shift to new intermediaries. The empirical record shows repeated cycles in which technical capabilities developed for commercial purposes migrate to government use with limited accountability.

Citizen Lab's findings rest on server connections, malware samples, and infection timelines rather than speculation. They demonstrate that zero-click methods once confined to messaging platforms have now merged with the broader ad ecosystem. Devices running everyday applications or visiting common sites become potential vectors. This development raises practical questions about the limits of device security when state resources can purchase access through legitimate-looking channels.

Further investigation may clarify the full scope of affected users and the identities of the governments involved. For now, the evidence establishes that commercial ad systems have been successfully adapted for invisible, selective surveillance operations. The pattern reflects how authority expands when technical means become available and oversight lags behind capability.