Zero-click spyware delivered through targeted ads, researchers find
Citizen Lab and Confiant documented targeted online ads being used to deliver Candiru spyware without a click, including confirmed infections on at least 45 Al Jazeera devices. The research shows how advertising identifiers can become surveillance selectors, but it does not mean every person who saw a Discover-Tech ad was infected.
What happened?
Confirmed research findings: on October 15, 2026, Citizen Lab published technical evidence that devices at Al Jazeera were infected with Candiru mercenary spyware through targeted advertisements purchased by the Israeli ad-technology company Discover-Tech. Citizen Lab says it confirmed at least 45 affected Windows devices during 2024 and 2025 by analyzing network logs supplied by Al Jazeera, infrastructure, and implant behavior. Confiant independently investigated Discover-Tech's advertising code and documented device fingerprinting, cloaking, and handoffs to infrastructure attributed by Citizen Lab to Candiru. Scale is not the same as infection: Citizen Lab found that ads containing attacker-controlled script tags were displayed across more than 120,000 websites and 75,000 mobile apps, and Reuters reported that the broader operation likely touched hundreds of millions of people. Those figures describe ad reach, tracking, or potential exposure—not hundreds of millions of spyware infections. Platform response: Google told Citizen Lab that it terminated Discover-Tech's access to its ad exchanges, Beeswax removed the company, Vungle paused access, Eskimi blocked its accounts and domains, and IAB Europe suspended its vendor status. Allegations and unresolved questions: Citizen Lab assesses that Discover-Tech facilitated multiple surveillance vendors and links the confirmed Al Jazeera infections to Candiru with high confidence. Discover-Tech and Candiru did not respond to Reuters or Citizen Lab within the reported timelines. No court has established liability, and the complete customer list, victim count, government involvement, exploited vulnerabilities, and current activity outside the blocked platforms remain unknown.
How the technology works
At a safe defensive level, real-time advertising auctions happen as a page or app loads. A bid request can expose or reference identifiers such as a mobile advertising ID, browser cookie ID, IP address, device characteristics, and approximate location. Citizen Lab says Discover-Tech's Controlium platform allowed a customer to choose a person or device using those selectors. When Discover-Tech won an ad auction, the displayed ad contacted a separate server. Most viewers received no attack code, but a preselected target could receive different JavaScript automatically when the ad rendered. That selective delivery reduced the chance that routine ad scanners would see the malicious response and meant the victim did not have to click the ad. The confirmed cases then used Candiru spyware. This article intentionally omits domains, indicators that could expose victims, exploit chains, payloads, and instructions for reproducing the technique.
Who is affected?
The confirmed victims were at least 45 Al Jazeera devices observed in 2024 and 2025. Citizen Lab and Confiant also found Discover-Tech ad impressions in government, media, technology, and international-organization networks and across many consumer apps and websites. An ad appearing on a device or network does not prove compromise. People facing elevated risk include journalists, activists, dissidents, lawyers, diplomats, government personnel, researchers, executives, and anyone targeted by a well-resourced surveillance customer. Ordinary users still face a broader privacy problem because the same advertising infrastructure can connect activity across sites and apps, fingerprint devices, infer location, and help turn an identifier into a real person. Organizations should not assume that an approved ad vendor, a reputable publisher, or a familiar app makes every advertising component trustworthy.
What should you do?
Individuals should update the operating system, browser, and apps promptly because zero-click delivery still usually depends on a software vulnerability after the targeting step. Use a reputable browser with strong anti-tracking protections and a trusted content blocker where policy and platform rules allow it. Disable personalized advertising and ad tracking, reset or delete the device's mobile advertising identifier when supported, limit unnecessary app tracking permissions, and remove apps that no longer receive security updates. People at elevated risk should separate sensitive work from general browsing, use an organization-managed device, and seek qualified incident-response help if they receive a spyware notification or observe credible signs of targeting; do not factory-reset first if evidence may be needed. Organizations should block advertising and tracking domains at managed gateways and endpoints where operationally feasible, disable unique advertising IDs through mobile-device management, restrict web content in sensitive environments, and monitor unusual ad-related requests without collecting unnecessary browsing histories. Security teams should use the researchers' current indicators through controlled threat-intelligence processes, preserve relevant DNS, proxy, endpoint, and network logs, and hunt for behavior rather than treating one blocked domain as complete protection. Ad platforms and publishers should require recurring vendor verification, analyze responses from real target environments instead of scanners alone, limit identifier sharing, and rapidly notify potentially affected customers when abuse is found.
My analysis
My Analysis — opinion and inference: targeted advertising has crossed a line when the machinery built to identify and follow people can also select them for silent compromise. This is not merely a malicious-ad problem; it is a predictable consequence of distributing detailed identifiers through opaque auctions involving companies most users have never heard of and cannot meaningfully audit. My privacy-first position is that real-time bidding should not expose persistent identifiers, precise location signals, or other data that lets an advertiser isolate a person. Consent banners and vendor registries are not adequate protection when an approved participant can serve different code only to a chosen target. My inference is that blocking Discover-Tech reduces this specific route but does not eliminate the structural risk, because the underlying targeting and code-execution capabilities remain available throughout the ad ecosystem; that is a risk assessment, not evidence that another vendor is currently running the same operation. Regulators should investigate the documented conduct, require independent audits and meaningful identity checks for ad buyers, enforce strict data minimization, and impose direct accountability on platforms that profit from distributing executable advertising code.
Why this matters
Cyber incidents often sound distant or overly technical. The important question is whether the same weakness, behavior, surveillance power, or exposure exists in systems you use. Facts and opinion are separated here so you can judge both clearly.
Facts, claims, and unknowns are separated above. Details may change as investigations and official statements develop.
Citizen Lab: Exposing AdFection—targeted ads as a zero-click spyware pipeline Confiant: ADINT—weaponized ad tech for spyware and identity collection Reuters: Israeli firm used online ads to run vast spy operation, researchers say