Citizen Lab Uncovers Zero-Click Spyware Delivered Through Targeted Online Ads

Every day, the global digital advertising ecosystem processes hundreds of billions of split-second auctions to decide which banner appears on a screen. That same automated infrastructure is now being weaponized to silently deliver zero-click mercenary spyware to targeted individuals. Researchers have documented a campaign that turns ordinary web browsing into a direct pipeline for device infection.[1][4]

The joint investigation by the University of Toronto’s Citizen Lab and the cybersecurity firm Confiant provides the first technical confirmation that targeted online ads are distributing sophisticated surveillance tools. The technique, dubbed "AdFection," requires no interaction from the victim. A target simply needs to load a webpage or open an app that displays a compromised advertisement.[1][4]

At the center of the operation is Discover-Tech, an Israel-based company that presented itself as a legitimate digital advertising agency. According to Citizen Lab, the firm actually operated a platform called Controlium that served as a bridge between the advertising ecosystem and mercenary spyware vendors. This platform allowed surveillance clients to precisely profile internet users and automatically infect them.[4]

The scale of the exposure is massive, with Discover-Tech pumping out at least 10 million advertisements every single day. Over a four-month period, the firm successfully bid on and placed advertisements across nearly 200,000 unique websites and 70,000 mobile applications. These ads reached networks associated with the United Nations, NATO, and the United States Department of Defense.[1][4]

How the zero-click mechanism operates

The technical mechanism relies on the standard architecture of real-time bidding, which broadcasts an advertising identifier and IP address to an auction platform whenever a user opens a page. Discover-Tech used this data to identify pre-selected targets and win the auction to serve them an ad. The initial advertisement itself does not contain the malicious payload.[4]

By keeping the exploit out of the initial ad, the campaign successfully bypassed automated security scanners used by ad networks like Google and Yandex. Instead, the ad executes a benign-looking JavaScript code that contacts Discover-Tech’s servers. If the server confirms the device belongs to a target, it seamlessly redirects the connection to an infection server.[3][4]

For the vast majority of users who are not targeted, the server simply returns a zero-byte response, leaving them unaffected and keeping the operation hidden. But for the selected few, the infection server delivers a browser exploit that silently installs the spyware in the background. The entire process happens in the milliseconds it takes for the banner to render.[2][4]

Citizen Lab confirmed that this exact mechanism was used to compromise at least 45 Windows devices belonging to journalists and staff at the Qatari broadcaster Al Jazeera in 2024 and 2025. Network logs provided by the media organization showed infected devices first contacting Discover-Tech infrastructure before communicating with servers linked to Candiru, a notorious Israeli spyware manufacturer.[4]

The role of blacklisted surveillance vendors

Candiru, which now operates under the name Integrity Labs, is not a new player in the commercial surveillance industry. The United States Commerce Department blacklisted the company in 2021 for supplying spyware used to target government officials, journalists, and activists. Despite these entity-level export controls, the firm has continued to deploy its tools through intermediaries like Discover-Tech.[2][4]

The spyware delivered in the Al Jazeera attacks is highly capable and designed for total device compromise. Once installed, it allows operators to take complete control of the hardware, extract encrypted messages, siphon off emails, record phone calls, and secretly activate the microphone and camera. Discover-Tech’s platform effectively gave these blacklisted vendors a stealthy, globally distributed delivery network.[4]

The discovery highlights a severe vulnerability in the digital advertising supply chain that allowed the campaign to run undetected. Discover-Tech managed to operate for years while appearing on lists of certified and approved vendors maintained by Google and the Interactive Advertising Bureau Europe. The company successfully purchased ad inventory through major networks, including Comcast's Beeswax platform.[3][4]

Following the disclosure of the investigation, major technology platforms took immediate action to sever ties with the firm. Google stated that it collaborated with the researchers and removed Discover-Tech from its ad platforms for systematically violating its policies. IAB Europe and Beeswax also suspended the firm's access, effectively cutting off its ability to purchase new advertising space.[3][4]

A systemic failure of industry self-regulation

Security experts argue that the AdFection campaign exposes fundamental flaws in how the advertising industry handles user data and vets its participants. The real-time bidding system broadcasts sensitive profiling data to thousands of companies simultaneously. This creates an environment where surveillance firms can easily identify and track targets without their knowledge, exploiting the very infrastructure that funds the web.[4]

"The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike," said Wolfie Christl, a senior researcher at Citizen Lab. He emphasized that the industry's self-regulatory frameworks completely failed to detect or prevent a massive espionage operation that was operating in plain sight.[4]

The researchers are calling on regulators to investigate Discover-Tech and its partners for potential legal violations, particularly regarding the European Union's General Data Protection Regulation. Discover-Tech allegedly exploited GDPR consent frameworks to target users within Europe. This demonstrates that current privacy laws are insufficient to stop state-sponsored surveillance tools from abusing commercial advertising networks.[3][4]

The Citizen Lab report also identified a separate, mysterious threat actor operating within the same infrastructure, dubbed "DARK CARTOGRAPHER." This entity reportedly exploited vulnerabilities across numerous mobile carriers to link anonymous device advertising IDs directly with users' phone numbers, enabling mass-deanonymization on a global scale.[4]

Confiant's parallel investigation revealed that Discover-Tech utilized cookie matching to expand its surveillance reach. This standard industry practice for sharing user data between different advertising platforms allowed the firm to track individuals even when they were browsing sites outside of Discover-Tech's direct inventory. The geographic spread of the malicious ads was vast, surfacing heavily in the Palestinian territories, Yemen, and Brazil.[1]

The revelation that commercial spyware can be delivered through standard programmatic advertising fundamentally changes the threat model for high-risk individuals. Previously, targets had to be tricked into clicking a phishing link or opening a malicious document. Now, simply visiting a mainstream news site or using a popular mobile application could result in a total device compromise.[2][4]

For individual users, defending against zero-click ad attacks is exceptionally difficult, as the infection requires no user error or interaction. Cybersecurity professionals are increasingly recommending network-level ad blockers and privacy-focused browsers as mandatory security tools, rather than just conveniences for avoiding visual clutter. Until the advertising industry fundamentally changes its architecture, the threat remains active.[2][3]