In a disturbing discovery, security researchers have found evidence that online ads on websites and mobile apps were widely exploited to deliver spyware to devices without users’ knowledge.
The spyware appears to have originated with the Israeli company Candiru, and was discovered infecting devices at Al Jazeera, according to researchers at the Toronto-based Citizen Lab.
Another Israeli firm, Discover-Tech, has been acting as the key facilitator by allegedly selling access to its online ads to spyware developers. “Discover-Tech operates a platform called Controlium that enables its mercenary partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered—a form of zero-click attack,” Citizen Lab writes in its report.
Zero-click refers to spyware that can automatically infect a device without any user interaction. In this case, the computer code that runs the online ad on the user’s device becomes the attack vector. The ad’s computer code can collect user data and send it back to Discover-Tech’s server. That server can then select which users are targeted with the spyware. To do so, Discover-Tech will connect the displayed ad to an “infection server” from the spyware provider, which can fetch JavaScript code to deliver the malicious payload.
Example of the ads. (Credit: Citizen Lab)
Citizen Lab’s report doesn’t appear to address the spyware’s capabilities or whether it exploited any software vulnerabilities to infect the devices. But the investigation led Al Jazeera to isolate “a Windows DLL file from one of the compromised devices” that has been flagged as malware and is designed to communicate with a Candiru attack server.
Citizen Lab found evidence that spyware was delivered to “at least 45 devices within Al Jazeera” in 2024 and 2025 after examining the media outlet’s network logs. The lab calls the attack “AdFection” and alleges that Discover-Tech’s primary purpose has been to secretly sell ads to multiple mercenary spyware providers rather than to legitimate customers.
How the attack works. (Credit: Citizen Lab)
Citizen Lab was also able to examine the ad-bidding records from Discover-Tech, which were accidentally exposed on the company’s website. “We found that Discover-Tech ads were displayed in over 70,000 mobile apps, and over 120,000 websites between March and June 2026,” the report says. The Israeli company has also served ads through Google, Russian search engine Yandex, and Comcast’s ad tech platform Beeswax.
Citizen Lab says the finding is “the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads,” three years after the newspaper Haaretz reported that Israeli firms had been using online ads to deliver spyware.
Another alarming discovery is that the malicious ads from Discover-Tech “were shown on devices in national-security-sensitive networks around the world. These include the networks of various ministries of defense, armed forces, national cyber agencies, intergovernmental organizations and multilateral security organizations including NATO, and networks associated with critical infrastructure,” Citizen Lab says.
The research also shows how online ads and ad targeting can be abused to enable mass surveillance, despite regulations. It’s long been known that online targeted ads work by collecting internet activity and device information to discern the user’s interests, geographic location, and also tag their device with an advertising ID, creating a way to “fingerprint” people, without their consent.
Recommended by Our Editors
“Sure, the targeting was designed to follow you around with shoe ads, but all Discover-Tech had to do was piggyback on this system to follow you around with spyware,” Citizen Lab researcher John Scott-Railton tweeted. “They are surely not alone. Just the first to get caught.”
Citizen Lab is calling on regulators “to investigate whether Discover-Tech and Candiru/Integrity Labs violated applicable laws, and make recommendations to lawmakers.”
Discover-Tech didn’t immediately respond to a request for comment. In the meantime, Citizen Lab notes that Google, the ad association IAB Europe, Beeswax, Vungle, and Eskimi all “took action to disconnect Discover-Tech’s access to the digital advertising ecosystem.”
Researchers at the lab also say users can protect themselves by blocking online ads. Google also says: “Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover Tech from our ad platforms for systematically violating our policies. We also set up Safe Browsing warnings to help protect people if they navigate to websites linked to this group.”
About Our Expert
Michael Kan
Principal Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Leave a Reply