Full Breakdown
Zero-Click Spyware Delivered Through Online Ads
By Drooid · · How we work
Core Event
Researchers at the University of Toronto’s Citizen Lab disclosed a campaign—dubbed “AdFection”—in which the Israeli-registered advertising firm Discover-Tech (also written DiscoverTech) used its ad-network platform, Controlium, to deliver zero-click spyware to targeted devices. The malicious code was injected when a device rendered a seemingly ordinary ad, requiring no user interaction. Citizen Lab linked the attacks to the Israeli spyware firms Candiru (now operating as Integrity Labs) and Bindecy, and identified at least 45 Al Jazeera computers compromised in 2024-2025. The researchers say the operation represents the first publicly documented technical evidence of sophisticated government-backed spyware being distributed through online advertising.
Background & Context
Zero-click exploits have previously been observed in mobile messaging apps. The ad ecosystem, which serves billions of impressions across roughly 200,000 websites, Android apps and iOS apps, offers a vastly broader attack surface. Earlier investigations reported that 36 Al Jazeera journalists were infected with Pegasus spyware from the Israeli firm NSO Group. The new findings show a shift from exploiting messaging platforms to abusing the ad supply chain itself.
Official Statements & Responses
- Google confirmed cooperation with Citizen Lab and Confiant, stating that Discover-Tech has been removed from Google Ads.
- IAB Europe, the European advertising trade body, announced the suspension of Discover-Tech from its vendor registry.
- Ad-security firm Confiant said it helped identify the malicious ads and noted that similar ads appeared on networks of the U.S. Department of Defense and the Dutch Economic Affairs Ministry, though placement does not prove targeted infection.
- Citizen Lab researchers recommended disabling mobile advertising IDs, using opt-out features, and employing ad-blocking tools, while acknowledging that such measures are not foolproof.
Criticism & Opposition
- “Any time we browse the internet or open an app, all the data on our device can be hacked by malicious actors without us even knowing,” — Natalia Krapiva, Access Now.
- “The adtech industry has a lot of rethinking to do to reconsider how they approach these threats of surveillance and the responsibilities they have with the data they collect,” — Jerome Dangu, Confiant.
- “The industry has optimized against cyber criminals, scams and malware for profit but not for surveillance,” — Wolfie Cristl, Citizen Lab.
These voices call for urgent technical, legal and regulatory measures to curb the abuse of ad infrastructure for espionage.
Conflicting Reports & Gaps
- Earlier reporting linked 36 Al Jazeera journalists to Pegasus infections attributed to NSO Group, whereas the current analysis attributes 45 devices to Candiru-derived spyware delivered via ads. The datasets refer to separate incidents and different spyware families.
- Citizen Lab could not attribute the AdFection campaign to any specific government, leaving the sponsoring actors unidentified.
- While bidding records show ads were served on high-value targets (e.g., the International Atomic Energy Agency, NATO), the report does not confirm whether those impressions resulted in successful infections.
What’s Next
Citizen Lab urges individuals to adopt ad-blocking tools, reset or disable advertising IDs, and consider broader defensive measures. The lab also calls on regulators in the United States, Europe and elsewhere to investigate Discover-Tech and related ad-tech vendors, and to address systemic risks that enable malicious ad targeting. A forthcoming report will detail a separate threat actor, “DARK CARTOGRAPHER,” which appears to exploit Discover-Tech’s infrastructure for mass de-anonymization.