Full Breakdown
Zero-Click Ads Turn Advertising Platforms into Spyware Delivery Pipelines
By Drooid · · How we work
The Discovery: Zero-Click Malware via Online Ads
On October 15, 2026, researchers at the University of Toronto’s Citizen Lab revealed that Israeli ad firm Discover-Tech used ordinary-looking ads to deliver the spyware Candiru without any user interaction. The technique, dubbed “AdFection,” exploits real-time bidding: a targeted ad loads, a hidden script checks the viewer’s identifiers, and for pre-selected victims silently installs spyware that can exfiltrate files, recordings, and credentials. The first confirmed infections involved 45 Windows devices used by Al Jazeera during 2024-2025.
Background & Context
Discover-Tech, founded in 2020, was listed as a certified vendor on Google’s platform and on IAB Europe’s Global Vendor List from July 2 2020. Its platform Controlium lets clients upload lists of advertising IDs, IP addresses, or cookies and then bid on ad slots that match those identifiers. Candiru was blacklisted by the U.S. Commerce Department in 2021 after evidence it was used to surveil officials, journalists, and activists.
Data & Statistics
- Ads appeared on over 120,000 websites and 75,000 mobile apps between March and June 2026.
- Discover-Tech submitted roughly 3.77 billion ad bids, winning about 442 million auctions; around 19 % of winning bids carried the malicious script.
- Confiant estimated at least 10 million ads per day worldwide, potentially touching hundreds of millions of users.
Official Statements & Responses
- Google blocked Discover-Tech from its ad platforms for “systematically violating” policies and enabled Safe Browsing warnings.
- IAB Europe removed the firm from its Global Vendor List on October 8 2026 after an audit.
- Beeswax (Comcast) and Vungle also suspended the firm’s access.
On-the-Ground Reports
Al Jazeera’s tech team observed anomalous network patterns on journalist devices in 2024. Logs showed a Discover-Tech ad impression, a Candiru validator request, and subsequent command-and-control traffic within minutes. The recovered Windows DLL matched Candiru’s known persistence mechanisms, allowing high-confidence attribution.
Conflicting Reports & Gaps
While ad impressions were recorded on many government and corporate networks, no confirmed infections have been reported outside the Al Jazeera case.
Verbatim Quotes
- “Discover-Tech posed as an ordinary advertiser, used that data to find their target and win the auction for that person’s screen,” — Stephen O’Shaughnessy, lecturer in cybersecurity.
- “Executing code inside the browser does not automatically give an attacker full control over the computer,” — Eddy Willems, analyst.
- “If you might be targeted based on who you are or what you do, it’s time to disable ad tracking on your devices or even block ads altogether,” — Bill Marczak, Citizen Lab.
Why It Matters
The investigation shows the online advertising ecosystem can be weaponised at scale, turning routine ad impressions into a covert espionage channel. By bypassing user interaction, the technique lowers barriers for state and non-state actors to conduct targeted surveillance, raising profound privacy and security concerns.
What’s Next
Citizen Lab and Confiant have urged regulators in the United States, Europe, and Canada to investigate the companies involved and to reform real-time bidding practices that expose personal identifiers. Advertising platforms are removing Discover-Tech, but broader industry safeguards remain pending.