Zero-Click Spyware Delivered Through Online Ads Confirmed in First Known Cases

Citizen Lab researchers at the University of Toronto have documented how government-linked operators are exploiting global advertising networks to deliver zero-click spyware that infects devices without any action from the target. The new report details a system where an Israeli firm called Discover-Tech routes malicious code through legitimate ad platforms, allowing spyware vendors to hit specific people or machines anywhere in the world. At least two known spyware makers, Candiru and Bindecy, have used the setup to push infections that steal data invisibly once a device loads an ad.

The attacks, labeled AdFection in the study, mark the first confirmed use of online advertising to deliver sophisticated zero-click government spyware. In one case uncovered by the lab, operators infected at least 45 Windows computers belonging to the media organization Al Jazeera during 2024 and 2025. The devices were compromised through Candiru spyware embedded in ads, giving the attackers remote access without the users clicking anything or opening suspicious messages. Researchers noted that victims would see nothing unusual, and in many instances the malicious ad itself might not even appear on screen.

Discover-Tech presents itself as a standard advertising company but functions as a direct link between ad vendors and the mercenary spyware market. This arrangement lets operators select targets with precision while hiding the operation inside the vast, automated world of digital ads that billions of people encounter daily. Citizen Lab found the connections through technical analysis of servers and infection patterns, confirming that the spyware reached devices through normal browsing rather than targeted phishing or messaging apps.

The zero-click method removes the usual safeguards that come from user error or obvious lures. Once the ad loads, the code exploits vulnerabilities to install the spyware, which can then monitor communications, location, and files. The report stresses that this approach scales easily because ad networks reach phones and computers across borders with little friction. No government has been publicly named as the customer in these specific incidents, yet the involvement of known mercenary tools points to state actors seeking deniable surveillance capabilities.

This development raises immediate concerns about how easily powerful tools can be aimed at journalists, activists, or any individual whose online habits fit a broad targeting profile. Media outlets and their staff already operate under constant pressure from various governments, and the addition of ad-based delivery makes routine web use a potential vector for compromise. The technique also blurs the line between commercial advertising infrastructure and intelligence operations, showing how private firms can enable state-level spying on a global scale.

Citizen Lab researchers described the scenario as a nightmare because ordinary people have almost no practical defense against it during normal internet activity. The report calls for greater scrutiny of ad networks and the companies that facilitate access to them, warning that the same channels could expand to affect far more devices if left unchecked. As governments continue to invest in these capabilities, the boundary between everyday online exposure and covert surveillance continues to shrink.