Researchers say Israeli ad firm routed zero-click spyware through ads
Citizen Lab and Confiant report that Discover-Tech used targeted ads to profile devices and deliver Candiru mercenary spyware without a click, including infections at Al Jazeera. Google and IAB Europe have cut the firm's vendor access; Discover-Tech did not respond to the researchers.
AI-assisted · US Brief desk · Sources listed below
What happened
On Oct. 15, the University of Toronto's Citizen Lab and ad-security firm Confiant published "AdFection," saying Israeli ad company Discover-Tech ran a Controlium platform that let mercenary spyware vendors profile millions of devices and infect selected targets through ordinary online ads — with no click required.
Why it matters
Real-time ad bidding reaches phones and browsers worldwide. If spyware can ride that pipe, journalists, officials and ordinary users can be hit while doing nothing more than loading a page or app.
More context
Primary finding (excerpted): Citizen Lab wrote that it has "high confidence" Al Jazeera devices were infected with Candiru spyware (also described as Integrity Labs) via Discover-Tech ads in 2024–25, and called the case "the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads." Ars Technica said at least 45 Al Jazeera devices were confirmed infected.
How the pipeline worked: Researchers say Discover-Tech ads sent identifiers to its servers; selected devices then received malicious JavaScript that handed off to Candiru infection infrastructure. Bidding records Citizen Lab reviewed showed Discover-Tech ads across tens of thousands of apps and sites, including impressions on NATO, UN and other government networks — impressions that show profiling risk, not proven infection in every case.
Industry response: Google and IAB Europe removed Discover-Tech from approved-vendor lists; Google and Beeswax cut platform access; other ad firms paused or blocked accounts, Citizen Lab and The Verge reported. Messages to Discover-Tech and Candiru went unanswered.
What would change the story: a Discover-Tech or Candiru rebuttal with forensic detail; government findings that named networks were infected; or new ad-exchange rules that block similar brokers. Citizen Lab advises high-risk users to use ad blockers, reset mobile ad IDs and keep devices updated.
5 listed sources
- Citizen Lab, Oct. 15, 2026
- Citizen Lab executive summary, Oct. 15, 2026
- Ars Technica, Oct. 15, 2026
- The Verge, Oct. 15, 2026
- Confiant, Oct. 15, 2026
References listed by US Brief; a source count is not a verification score.
Editorial sourcing notes
Citizen Lab says this is the first public technical confirmation of zero-click mercenary spyware via ads. Discover-Tech and Candiru did not answer researcher messages. Hero is a generic smartphone file photo, not a device from the Al Jazeera case.
Like US Brief? You can support it with a tip.