Citizen Lab Publishes First Confirmation of Zero-Click Spyware Delivered Through Targeted Ads

It takes less than a second for an ad to appear on a webpage or in an app. In that time, an advertising exchange holds an auction to decide whose ad to show. The winning advertiser's images and code are then delivered to the user's device. In a report published on October 15, the University of Toronto's Citizen Lab provided the first public confirmation that these auctions had been used to deliver spyware that infects devices without the user clicking anything.

The victim in the case documented by the report was the international news broadcaster Al Jazeera. Its devices were infected through targeted ads carrying spyware from the Israeli surveillance company Candiru, with at least 45 devices targeted. Citizen Lab called the technique AdFection. The ads were purchased by Discover-Tech, an Israeli company that had presented itself as a legitimate advertising business.

Discover-Tech's platform, Controlium, automatically identified and fingerprinted devices, then infected them as soon as an ad rendered on screen. After analyzing nearly four billion bidding records, the researchers found that the company's ads appeared on over 120,000 websites and over 70,000 mobile apps from March to June 2026. The ads also caused millions of devices to connect covertly to Candiru servers.

The company appeared on certification and approved vendor lists maintained by Google and the European advertising industry association IAB Europe, and served ads through major advertising networks including Google, Yandex, and Beeswax. After being notified by the researchers, Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi took steps to cut off Discover-Tech's access.

That changes the questions developers need to ask when building services that carry ads. Until now, ad slots have been treated as a question of how much revenue they can generate. But as this report shows, an ad slot is also a channel that lets whoever wins an auction run code on our users' devices.

Our own code invites bidders into the auction. According to Citizen Lab, the supply-side platform (SSP) code that sites and apps embed to display ads sends information such as device identifiers, precise location, and IP addresses to exchanges to solicit bids. The auction is designed to use those values to select an individual and show them an ad. Ultimately, we cannot choose which ad arrives, but we do decide what our pages and apps send into the auction.

Still, the report's strongest recommendation was to block ads on the receiving end. It recommended ad blocking as a security practice for those responsible for protecting organizations, saying there is currently no consistently safe way to expose users and networks to targeted ads. It also noted that blocking advertising identifiers could stop Discover-Tech's current method, while the scope for attacks could be broader.

For services that carry ads, today's task is to take inventory. Document exactly which values the ad SDKs and tags in your apps and pages send into auctions, then start removing values the service does not strictly need, such as advertising IDs and precise location. An ad slot is no longer just a revenue setting. It is a decision about what we let onto our users' devices.

Sources

1. Citizen Lab: Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware, Citizen Lab Report 195, October 15, 2026, by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis, and Ron Deibert.