Researchers at the University of Toronto’s Citizen Lab say they have documented the first public technical confirmation of zero-click mercenary spyware delivered through targeted online advertising.
The technique, which the researchers call AdFection, can compromise a selected device when an advertisement is rendered. The target does not have to click the ad, open a suspicious attachment or install an application. Citizen Lab says it linked the system with high confidence to at least 45 devices at Al Jazeera that were infected in 2024 and 2025 with spyware attributed to Candiru, which now operates under the Integrity Labs name. Citizen Lab published the full technical investigation on October 15.
How an ordinary ad became an attack path
Modern online advertising often relies on real-time bidding. When a website or app opens an ad slot, advertising companies compete in milliseconds for the chance to display something to that device. The same system can expose identifiers and technical information that help advertisers decide who should receive an ad.
Citizen Lab says Israeli ad-tech company Discover-Tech used that infrastructure through a platform called Controlium. Ads could contain a small script that contacted a Discover-Tech server with information such as an advertising identifier or IP address. If the device was not a selected target, the server could return nothing. If it matched a target, the server could return JavaScript that started an exploit chain.
That selective response is important because it makes conventional ad inspection much harder. An automated scanner can examine the same advertisement and receive an empty response, while only a particular target receives the attack code. It is a security problem built around identity, targeting and execution rather than a visibly malicious banner.
Nearly four billion ad bids exposed the scale
The researchers analyzed almost four billion Discover-Tech bidding records covering March through June 2026. Citizen Lab says ads containing its attack-related script appeared across roughly 200,000 unique websites and mobile applications in dozens of countries.
That figure describes the reach of the advertising infrastructure, not the number of confirmed infections. Citizen Lab found impressions on networks associated with governments, international organizations and critical infrastructure, but an ad impression by itself does not prove that a device was targeted or compromised. The confirmed infection evidence in the report centers on the Al Jazeera devices.
Reuters independently reported that major advertising services moved to cut Discover-Tech off after the findings, while Discover-Tech and the spyware vendor did not provide responses to the news organization’s requests for comment.
Why zero-click changes the defensive model
Traditional security advice often centers on not clicking unknown links. AdFection shows why that is no longer enough for high-risk targets. The browser or app can receive executable content as part of normal advertising behavior, which means a victim may do nothing beyond visiting an ordinary page.
The discovery fits a broader pattern in which legitimate infrastructure becomes the delivery path for malicious code. BitcoinVersus.Tech recently covered a fake Web3 accelerator spreading malware, while our guide to the seven layers of cybersecurity explains why endpoint, network and application defenses have to overlap rather than depend on one control.
The same defense-in-depth principle applies to connected industrial systems. Our report on why industrial devices should stay off the public internet shows how reducing unnecessary exposure can shrink the attack surface before a vulnerability is exploited.
What users and organizations can do
Citizen Lab recommends stronger ad blocking for people at elevated risk, including blocking at the network gateway where practical. Users can also disable or reset advertising identifiers and keep operating systems, browsers and applications updated. Organizations managing high-risk devices can enforce those settings centrally through mobile-device management and network policy.
The report does not identify the exact vulnerability chain used in every infection, and it does not name the government or other customer behind the confirmed Al Jazeera attacks. Those limits matter. What the researchers say they have established is narrower and technically significant: targeted advertising infrastructure was used as a delivery system for mercenary spyware that could infect selected devices without a click.
BitcoinVersus.Tech Editor’s Note:
We volunteer daily to ensure the credibility of the information on this platform is Verifiably True. If you would like to support to help further secure the integrity of our research initiatives, please donate using the QR code provided
For best QR-code scanning results, please scan this donation code from a desktop or larger screen. Mobile screens may prevent camera recognition.
Leave a Reply