Citizen Lab links targeted adverts to zero-click spyware attacks on Al Jazeera devices
Citizen Lab says it has identified the first publicly confirmed case of zero-click mercenary spyware being delivered through targeted online adverts. The alleged operation used advertising technology to target devices without users clicking links or downloading files, raising concerns about the security and oversight of online ad networks.
Researchers say Israeli firm Discover-Tech used its Controlium platform and real-time bidding data to identify devices and serve malicious adverts. They linked the method, called “AdFection”, to Candiru spyware and at least 45 devices at Al Jazeera in 2024 and 2025. Analysis of nearly four billion bidding records found Discover-Tech adverts across more than 70,000 apps and 120,000 websites; Google and several other companies have since cut ties with the firm. Researchers found no evidence that government, defence or NATO networks exposed to the adverts were infected.
- Citizen Lab linked targeted adverts to zero-click spyware attacks.
- At least 45 Al Jazeera devices were reportedly infected.
- Google and other ad companies removed Discover-Tech.
New here? Start with this
Mercenary spyware is software sold to clients to secretly monitor phones and other devices. A “zero-click” attack can infect a device without its owner opening a link or installing anything, making it harder to spot and avoid.
Citizen Lab is a research group that investigates digital threats, while Al Jazeera is an international news organisation. The report describes an alleged operation involving Discover-Tech, an Israeli company, and its advertising platform; researchers also linked the adverts to Candiru, a maker of spyware.
Online adverts are placed through systems that use data about devices and users to decide which advert to show. If those systems can be used to deliver spyware, it raises questions about how advertising networks are monitored and how devices can be protected.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
If Citizen Lab’s findings are accurate, using ad-targeting infrastructure to deliver spyware without any user action exposes a serious gap in the security and oversight of online advertising. The reported targeting of journalists’ devices makes independent scrutiny and stronger safeguards especially important, while the companies’ decision to cut ties with Discover-Tech shows how platforms can respond to credible security concerns.
The case against
The allegations are consequential, so a careful advocate would stress that they remain research findings about a specific operation, not proof that ad networks generally are unsafe or that any government directed the attacks. The researchers found no evidence of infection in the government, defence or NATO networks they examined, and responses should distinguish the alleged conduct of one firm from the wider advertising ecosystem while relying on transparent evidence and fair process.
Read the full article at the source →
Originally published by The Register as “Spyware vendors found a way to make targeted ads even worse”.