For years, security experts warned that the machinery behind online advertising could be turned into a delivery system for spyware. This week, researchers say they finally caught it happening. In a report published Thursday, the University of Toronto’s Citizen Lab documented what it calls the first public technical confirmation of zero-click mercenary spyware delivered through targeted ads — infections that required no click, no download, and no action at all from the victim.
The researchers named the technique “AdFection.” At its center sits Discover-Tech, an Israeli company that presented itself as an ordinary advertising firm. According to Citizen Lab, its real role was to bridge two industries: it bought ads through mainstream exchanges while giving surveillance vendors a way to find specific people inside that traffic and single out their devices.
How an ordinary ad becomes an attack
Modern ads are chosen in real-time bidding auctions that run in the split second before a page or app loads, and the winning ad can carry code that runs on the viewer’s device. Citizen Lab says Discover-Tech’s buying platform, MyDSP, won those auctions, and that its ads contacted company servers when they rendered, sending back details such as the device’s advertising identifier and IP address.
For almost everyone, that was the end of it — the servers replied with nothing. But if the device matched a selected target, the response was different: additional code routed it, through an invisible frame, to a validation server and then toward an exploit and spyware. The ads themselves carried no exploit code, Citizen Lab found, which helped the operation stay invisible to the platforms distributing the ads. A separate platform run by Discover-Tech, called Controlium, let customers profile and select targets using advertising IDs, cookie identifiers, and IP addresses, the researchers say.
At least 45 devices at Al Jazeera
The strongest evidence comes from a newsroom. Citizen Lab tied the technique, with high confidence, to infections of at least 45 devices at the broadcaster Al Jazeera during 2024 and 2025. Network logs the broadcaster shared showed compromised devices contacting Discover-Tech infrastructure first, then validation servers associated with Candiru, and then command-and-control servers.
Candiru is an Israeli mercenary spyware vendor that now operates under the name Integrity Labs and was placed on the US government’s Entity List in 2021. Citizen Lab says Discover-Tech’s infrastructure also served other surveillance firms, including companies it names as Bindecy and Intelos. Ad-security firm Confiant published a parallel investigation on the same day, based on ad traffic it had observed.
Enormous reach, narrow targeting
The scale of the profiling is what sets this apart from a conventional hacking campaign. Citizen Lab reviewed nearly four billion bidding records from March to June 2026 and found that Discover-Tech bid on about 3.77 billion impressions and won roughly 442 million of them. Its ads appeared across more than 120,000 websites and more than 70,000 mobile apps, and the records showed impressions reaching networks associated with organizations including the US Department of Defense, NATO, the United Nations, and the European Commission.
The researchers are careful about what that reach does and does not mean. Seeing one of these ads did not infect a device; most ads delivered nothing at all. The system’s purpose was to observe at enormous scale so that a tiny number of chosen devices could be attacked at exactly the right moment.
Cut off — and probably not the last case
After the findings were validated jointly with Confiant, Google removed Discover-Tech from its advertising platforms and vendor lists, and IAB Europe and several other ad platforms suspended or blocked the company, according to reporting on the investigation. Discover-Tech did not respond to requests for comment from WIRED or TechCrunch.
Citizen Lab says a follow-up report is coming on a related actor it calls DARK CARTOGRAPHER, which it says used the same infrastructure to link people’s advertising IDs to their phone numbers. For regular users, the researchers’ practical advice is blunt: blocking ads now functions as a security measure, not just an annoyance filter. The deeper problem the report exposes is structural — an ad ecosystem built to identify everyone, in real time, turns out to be an almost perfect tool for finding the one person a spyware customer wants.
More from Chip Current’s Cybersecurity coverage.
