Spyware Delivered by Ads: How Zero-Click AdFection Works

By Jaspal Singh October 15, 2026 Updated: October 15, 2026

Spyware can now arrive through an ordinary online ad. On October 15, 2026, Citizen Lab confirmed that an Israeli ad firm, Discover-Tech, let mercenary spyware vendors pick out specific phones and computers through real-time ad auctions and push code to them without a single tap. Here is how that pipeline works and what limits it.

What Happened

Citizen Lab, the digital-rights lab at the University of Toronto, published a report titled "Exposing AdFection" on October 15, 2026, written by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert. It describes what the authors call the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. The ad-security company Confiant released a parallel investigation the same day, based on ad traffic it observed between April 1 and September 10, 2026.

The central company is Discover-Tech, which presented itself as a demand-side platform, the kind of firm that buys ad space on behalf of advertisers. According to Citizen Lab, its real business was acting as a bridge between the ad market and surveillance vendors. Its customers used a control panel called Controlium to aim ads at chosen targets.

The researchers tie the platform to two spyware makers. Candiru, which has rebranded as Integrity Labs, is linked with high confidence to the targeting of at least 45 devices at the broadcaster Al Jazeera in 2024 and 2025. A second vendor, Bindecy, had operators logging in to Controlium from several European countries and Singapore. A surveillance firm named Intelos had at least 15 Controlium users.

The scale came from Discover-Tech's own leaks. Citizen Lab reviewed nearly four billion bidding records from March to June 2026. Discover-Tech's bidder offered on about 3.77 billion ad impressions and won about 442 million, an 11.7% win rate, and its ads appeared in roughly 75,000 apps and 120,000 websites. Confiant separately counted about 10 million Discover-Tech impressions a day across 228 countries.

Several ad companies acted before publication. Google told Citizen Lab it had terminated Discover-Tech's access to its ad exchanges and added known attacker domains to Safe Browsing. IAB Europe removed the firm from its vendor registry in early October 2026, the Beeswax platform removed it, Liftoff's Vungle exchange paused it pending review, and Eskimi blocked its accounts. Discover-Tech, Bindecy, Intelos and Microsoft's Xandr did not respond in time, according to the report. TechCrunch reported that Integrity Labs could not be reached.

Why It Matters

Zero-click spyware used to need a flaw in a specific messaging app, such as iMessage or WhatsApp, and a way to send the victim something. Ads remove the second problem. Almost every free app and news site loads ads from auctions it does not control, so an attacker who can win those auctions can reach a target wherever they browse, without knowing their phone number or email address.

The targeting is also sharper than most people assume. Every ad auction shares data about the device being shown the ad, including its IP address and, on phones, its mobile advertising ID. That ID is meant to measure campaigns, but here it worked as a homing beacon. Controlium let customers upload lists of advertising IDs, cookie IDs or IP addresses and serve special ads only to those devices.

The reach is what alarmed the researchers. Bidding records show Discover-Tech ads landing on networks belonging to defence ministries, central banks, police forces, electoral bodies, NATO and UN offices, EU institutions, power-grid operators and defence contractors. Citizen Lab stresses that an ad impression does not prove an infection. It does show that the delivery channel was pointed at sensitive organisations, and that the industry's vetting failed: Google and IAB Europe had listed Discover-Tech as a vendor from 2020 to 2026.

It also widens the threat beyond spyware. Confiant found Discover-Tech ads reading the cookies of the pages they ran on across more than 1,000 publisher sites, and syncing identifiers at a scale it put at billions of touchpoints a month. Confiant assesses that this kind of data can build an identity graph that links a person to their advertising ID, which is exactly what an attacker needs to pick one device out of millions.

How It Works

The attack uses the normal machinery of programmatic advertising. When an app or web page has an ad slot to fill, it sends a bid request to ad exchanges. That request carries details about the device: IP address, operating system, device model, rough location and an advertising or cookie ID. Bidders have a fraction of a second to decide whether to buy the slot. Discover-Tech was one of those bidders.

Citizen Lab and Confiant describe the delivery in stages:

Win the auction. Discover-Tech bids on the impression. If it wins, its ad is rendered in the app or page. The ad does not even need to be visible to the user.
Phone home. The ad contains a script tag pointing to a Discover-Tech server, which Citizen Lab calls the NOAS server. The script passes along the device's identifiers and IP address.
Decide quietly. The server checks those details against the customer's target list. For everyone else it returns an empty, zero-byte response, so ad exchanges reviewing the creative see nothing malicious.
Hand off. For a match, the server returns JavaScript that opens a hidden 1x1 iframe pointing to the spyware vendor's own infrastructure. Confiant captured one such iframe loading an obfuscated 90 KB script that set up an encrypted channel to a command server and could run whatever code the operator sent.
Exploit and infect. In the Al Jazeera case, Citizen Lab traced a sequence from the ad impression to a Candiru "validator" server, then to profiling and infection, then to a Candiru command-and-control server. A Windows DLL isolated from an Al Jazeera machine matched Candiru's known 2021 implant.

The "zero-click" label refers to the victim's role: they only have to load a page or app that shows an ad. The actual break-in still depends on a browser or operating-system exploit delivered at the last stage, and neither report captured that exploit itself.

Controlium added operational security on top. Ad URLs carried encrypted parameters with the target's IP, timestamp, user agent and advertising ID, which the researchers believe let attackers confirm they had the right device before revealing an exploit. The panel also showed customers the ad impressions and bid requests tied to an identifier, which on its own works as a location and activity tracker. Ironically, the panel was poorly secured: its login check could be forged with a key shipped in its own front-end code, and an open endpoint exposed 128 days of login logs covering 120 usernames. That is how the researchers saw who was using it.

What's Still Unknown

The biggest gap is the exploit. Neither report documents which vulnerability reached Al Jazeera's computers or whether phones were compromised the same way, so it is not clear whether current browser patches already close the hole.

The victim count is also uncertain. Citizen Lab can say 45 Al Jazeera devices were targeted, not how many were fully infected. It cannot say whether any government or military user who saw a Discover-Tech ad was actually compromised. Which governments hired Candiru or Bindecy for these operations is not established either, although one Candiru link carried data pointing to a Saudi foreign ministry IP address.

Finally, Discover-Tech is unlikely to be alone. Marczak told TechCrunch the firm is probably just the tip of the iceberg, and Citizen Lab says a separate report on a related actor, which links advertising IDs to phone numbers, is coming. Whether other exchanges and ad networks will cut off similar bidders, or whether regulators will restrict personal data in ad auctions, remains open.

Frequently Asked Questions

What is zero-click spyware?

Zero-click spyware infects a device without the owner opening a link, attachment or message. It relies on a flaw in software that processes content automatically, such as a messaging app or a web browser rendering an ad. Once installed, commercial spyware like Candiru's can typically read files, messages and credentials. The victim usually sees no sign that anything happened, which is why it is prized by government customers.

How can an online ad install spyware?

An ad is a small piece of code the page or app runs. In this case the ad sent the device's IP address and advertising ID to Discover-Tech's server. If the device was on a target list, the server replied with JavaScript that loaded a hidden frame from the spyware vendor, which could then deliver an exploit. Everyone else got an empty reply, so nothing looked suspicious.

Was my phone targeted by Discover-Tech ads?

Probably not by spyware. Discover-Tech's ads reached enormous numbers of ordinary users, but the spyware hand-off was reserved for chosen targets, and Confiant saw it at low daily volumes in a handful of countries. Journalists, activists, diplomats and staff of governments or international bodies face the real risk. Ordinary users were still exposed to the cookie and identifier collection both reports describe.

Do ad blockers protect against this attack?

They help. If an ad never loads, its script cannot phone home, so Citizen Lab recommends a trusted ad-blocking browser extension, a network-level ad blocker or a VPN that blocks ads. Ad blockers are not perfect, because ads inside apps are harder to filter, and a determined attacker can use other delivery routes. They remove one of the cheapest paths to reach you.

Should I reset or turn off my advertising ID?

Yes, if you are concerned. Citizen Lab advises regularly resetting your mobile advertising ID, turning off ad tracking in your phone's settings and using app opt-outs. On iPhone that means declining app tracking requests; on Android you can delete the advertising ID in Google settings. Without a stable ID, attackers lose one of the main ways to pick your device out of an auction.

Who are Candiru and Bindecy?

Both are Israeli surveillance vendors that sell hacking tools to governments. Candiru, now operating as Integrity Labs, was added to the US Commerce Department's entity list in 2021 after earlier Citizen Lab research tied it to attacks on journalists and activists. Bindecy is less well known; Citizen Lab links it to products called Archer and Cupid and found operators in several European countries.

What did Google do about Discover-Tech?

Google told Citizen Lab it terminated Discover-Tech's access to its ad exchange platforms, which stops the firm bidding on or serving ads through them, and deployed Safe Browsing protections against known attacker-controlled domains. IAB Europe, Beeswax, Liftoff's Vungle and Eskimi also removed, paused or blocked the company. Microsoft's Xandr had not responded by the report's deadline.