Citizen Lab uncovers government spyware delivered through online adverts
Developing story first seen 2 hours ago
Google has suspended Discover-Tech from its global advertising vendor list after an investigation with Citizen Lab and Confiant found the company had systematically violated its policies. The move follows a report about AdFection, spyware that can infect devices when a malicious advert is displayed, without the user clicking or taking another action.
Citizen Lab says Israeli company Discover-Tech used online advertising systems to identify and target users, and describes the case as the first confirmed delivery of government-backed, zero-click spyware through online ads. The report says the company served 442 million ads on more than 120,000 websites, including the BBC and New York Times, and apps such as Duolingo, Badoo and Grindr; targets reportedly included journalists and people linked to Al Jazeera, NATO, the European Commission, NVIDIA and Arm. Discover-Tech and other players have not commented.
- Google has blocked Discover-Tech from its ad platforms.
- AdFection can infect devices through an advert display alone.
- The ads reportedly appeared on more than 120,000 websites.
New here? Start with this
Spyware is software designed to secretly monitor or access a device. Most digital attacks require someone to click a link or install a file, but “zero-click” attacks can work without any action from the person targeted.
Online adverts are placed through networks that connect advertisers with websites and apps. Citizen Lab is a research group at the University of Toronto that investigates digital threats, while Discover-Tech is an Israeli advertising technology company; Google runs major advertising platforms used to place ads across the internet.
The case matters because advertising is a routine part of browsing, and malicious code in an advert could reach people as they use ordinary websites or apps. The report says the targeting included journalists and people linked to public bodies and technology firms, raising questions about how advertising systems can be used for surveillance.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The report points to a serious threat to privacy and security: if ordinary ads can install spyware without a click, people may be exposed simply by using familiar websites or apps. Targeting journalists and people connected to public institutions raises concerns about surveillance chilling reporting and undermining trust in advertising systems; blocking the company from Google’s platforms is therefore a defensible protective step.
The case against
Governments may argue that spyware can be a valuable tool for investigating serious threats, and that covert methods can be necessary when suspects evade conventional surveillance. They could also contend that the report’s findings do not, by themselves, establish the purpose or legality of each alleged targeting, so responses should distinguish legitimate, authorised investigations from abuse while relying on evidence and due process.
Full account
Citizen Lab says it has uncovered a form of government-backed spyware delivery that can infect a device simply by displaying an online advert. The researchers describe it as a zero-click attack: users need not click a link or open a file. Their investigation with advertising security firm Confiant identifies Israeli ad technology company Discover-Tech as a conduit between advertising networks and spyware operators.
According to the researchers, Discover-Tech’s Controlium platform used information from the online advertising system to identify and profile people, including through IP addresses and mobile advertising or browser identifiers. It could then direct malicious code to selected devices inside adverts that appeared ordinary. Citizen Lab calls this the first technical confirmation of zero-click government spyware delivered through online advertising.
The reports say the activity included attempts to infect devices used by staff at Al Jazeera. The joint investigation found at least 45 devices at the Qatar-based broadcaster targeted in 2024 and 2025 with spyware linked to Candiru, an Israeli spyware company. Citizen Lab also describes exposure across a much wider online advertising ecosystem, including major websites and apps, and says the ads appeared on devices associated with governments, militaries and other sensitive organisations.
Several advertising bodies have taken action. Google says it blocked Discover-Tech after its joint investigation with Citizen Lab and Confiant; the reports also say Comcast-owned Beeswax removed the firm and IAB Europe suspended it from its approved-vendor list. Researchers urge advertising platforms to strengthen safeguards. For people at higher risk, they recommend disabling ad tracking, using ad blockers and regularly resetting mobile advertising identifiers. Discover-Tech and other parties named in the reports had not commented.
Where outlets differ
The first report foregrounds Citizen Lab’s description of the operation as the first confirmed zero-click government-backed spyware campaign delivered through adverts, and gives estimates of 442 million ads across more than 120,000 websites. The second focuses more on Controlium’s profiling and targeting functions and specifies that at least 45 Al Jazeera devices were targeted in 2024 and 2025.
The first names a range of organisations whose employees or officials were reportedly exposed, including NATO, the European Commission, NVIDIA and Arm, and lists sites and apps where Discover-Tech ads appeared. The second centres on Al Jazeera and Candiru, and adds the actions by Beeswax and IAB Europe alongside Google’s removal of the firm.
More coverage
Read the full article at the source →
Originally published by Engadget as “CitizenLab details new spyware triggered by online advertising”.