Zero-Click Spyware Delivered Through Online Ads Confirmed in First Known Cases

Security researchers have uncovered a new method by which state-linked actors are delivering sophisticated spyware through the infrastructure of everyday digital advertising. A report released Thursday by Citizen Lab at the University of Toronto details how an Israeli advertising firm called Discover-Tech has served as a conduit for mercenary spyware operators to target devices without any visible signs to the victim.

The findings mark the first public technical evidence that zero-click spyware capable of stealing data invisibly has been distributed through online ads on a significant scale. Two spyware vendors, Candiru and Bindecy, are identified as having used the platform to reach specific individuals or groups almost anywhere in the world. The attacks require no clicks or messages from targets and can compromise devices running common operating systems during routine browsing or app use.

One documented campaign struck at least 45 Windows computers belonging to journalists and staff at the media organization Al Jazeera. The infections occurred in 2024 and 2025 through malicious code embedded in advertisements served via Candiru’s tools. Citizen Lab researchers note that the operators behind these intrusions remain unidentified, though the pattern aligns with known government-backed surveillance efforts.

The method, labeled AdFection in the report, exploits the vast reach of global ad networks to automate the delivery of invasive malware. Senior researcher Bill Marczak described the risk in stark terms, observing that victims would detect nothing unusual and might not even encounter a visible advertisement. This approach merges two longstanding threats: the use of mercenary spyware sold to states and the exploitation of commercial advertising systems that touch billions of devices daily.

Discover-Tech presents itself publicly as a standard advertising intermediary connecting vendors with clients. Citizen Lab’s analysis, however, shows it functions as a bridge to the spyware market, allowing operators to select precise targets while masking the malicious payload within legitimate-looking ad traffic. The firm’s Israeli registration and connections to servers linked to known spyware entities raise further questions about oversight in the commercial surveillance industry.

The implications extend well beyond any single newsroom. Zero-click exploits delivered at scale through ads could place journalists, activists, human rights defenders, and ordinary users in multiple countries at heightened risk. Previous high-profile spyware cases have relied on more targeted vectors such as messaging apps. Shifting the attack surface to ubiquitous advertising networks removes even those limited barriers and multiplies the potential number of victims.

Citizen Lab’s work builds on years of documentation showing how commercial spyware tools migrate from purported law-enforcement uses to broader political surveillance. The Al Jazeera infections fit a recurring pattern in which media outlets critical of certain governments become priority targets. Without stronger regulation of both spyware sales and the ad-tech ecosystem that enables such campaigns, the report warns that similar operations will likely proliferate.

Advocacy groups and digital rights organizations have long called for export controls and transparency requirements on firms selling surveillance technology. The latest evidence suggests those measures remain inadequate against an industry that continues to adapt its delivery methods faster than oversight mechanisms can respond.