Zero-Click Spyware Was Delivered Through Online Ads to Al Jazeera Devices, Citizen Lab Says
Researchers at the University of Toronto’s Citizen Lab say they have found the first public technical proof of zero-click spyware delivered through online ads. In a report published October 15, they say devices at Al Jazeera were infected with spyware from Candiru, an Israeli vendor, after targeted ads loaded.
Al Jazeera condemned the attack as an assault on press freedom, according to Democracy Now.
What Citizen Lab Found
Citizen Lab says at least 45 Al Jazeera devices were targeted in 2024 and 2025. It links the attacks with high confidence to Candiru, which has rebranded as Integrity Labs. CyberScoop adds that Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024. Network logs from Al Jazeera showed the same pattern each time: contact with an ad company’s servers, then a Candiru server that checks the device, then a command server.
Al Jazeera also pulled a Windows file from an infected device. Its code matched techniques in a Candiru tool that Citizen Lab analyzed in 2021. The Next Web notes that the US blacklisted Candiru that same year.
How the Attack Works
The ads were bought by Discover-Tech, an Israeli company that presents itself as a normal advertising firm. Citizen Lab says it actually acts as a bridge between advertising networks and several spyware vendors.
Its platform, called Controlium, lets customers identify a device and infect it the moment an ad is displayed. The ad carries a small script that calls back to a Discover-Tech server. If the viewer is not an eligible target, the server sends back nothing. That design keeps malicious code away from the ad companies that carry the ads.
In most cases, the person who sees the ad is not selected for targeting, Citizen Lab says.
How Far the Ads Spread
Citizen Lab analyzed nearly four billion of Discover-Tech’s ad bidding records. The report was published alongside a separate investigation by the ad-security firm Confiant. Citizen Lab found ads with attacker script tags displayed in about 75,000 apps and about 120,000 websites between March and June 2026.
The impressions appeared on sensitive networks, including NATO and United Nations networks. Citizen Lab stresses that an ad impression does not prove infection. It says the finding warrants an urgent investigation. CyberScoop reports that the researchers cannot currently attribute the AdFection attacks to any specific party.
The Industry Response
Citizen Lab says Discover-Tech sat on Google’s and IAB Europe’s lists of approved ad vendors from 2020 until 2026. Both removed it in early October 2026. Beeswax took it off its ad-buying platform, Vungle paused its access, and Eskimi blocked its accounts.
Citizen Lab says it sent requests for comment to 13 companies. The researchers call on regulators to investigate Discover-Tech and Candiru. Neither company responded to Citizen Lab’s requests for comment, The Next Web reports.
What It Means for Everyday Users
This section is our own view, not part of the reporting.
Mercenary spyware is normally aimed at specific, high-value targets such as journalists, activists and officials. Most readers are unlikely to be selected. Even so, the story shows that ads can carry code, and that vendors can pass review checks for years.
Basic habits still help. Install system and browser updates promptly, since zero-click attacks rely on unpatched flaws. A reputable content blocker may reduce exposure to ad-delivered code, although it is no guarantee. People who think they may be targets should seek expert help.
For related reading, see our report on the iOS patch for zero-click spyware, our guide to protecting your digital privacy in 2026 and our coverage of the Chrome 152 security update.
