On October 15, 2026, researchers from The Citizen Lab at the University of Toronto reported a case of spyware infecting devices through targeted advertisements. The campaign, referred to as "AdFection," allegedly involved an Israeli-registered advertising firm connected to spyware servers, resulting in the infection of numerous devices with malware. Citizen Lab claims this is the first detailed evidence of spyware being distributed via digital ads.
Zero-click hacks, which install malware without user interaction, pose significant risks to victims. Historically, such attacks have exploited vulnerabilities in messaging apps, but this new evidence shows that the online ad ecosystem can also be exploited for malware distribution. Bill Marczak, a senior researcher at Citizen Lab, stated, "AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet."
The report indicates that 45 devices belonging to Al Jazeera were targeted with zero-click attacks delivered through ads. The ads were issued by the Israeli-founded marketing firm Discover-Tech and linked to spyware attributed to the developer Candiru. Citizen Lab's analysis revealed that infected devices interacted with domains associated with Discover-Tech, which then connected to Candiru's infrastructure.
Google terminated Discover-Tech's registration after confirming a spyware link through a joint investigation with Citizen Lab and cybersecurity firm Confiant. A Google spokesperson stated, "Following a joint investigation... Google blocked Discover-Tech from our ad platforms for systematically violating our policies."
The Interactive Advertising Bureau (IAB) Europe suspended Discover-Tech from its global vendor list after an audit of its policies. A spokesperson for IAB Europe noted that further confirmation of spyware findings could lead to a definitive expulsion from the list.
The Citizen Lab researchers highlighted that Discover-Tech operates an advertising platform, Controlium, which can potentially allow users to "de-anonymize, fingerprint, and automatically infect devices" through ads. They estimated that millions of devices were directed to Candiru's servers, where profiling could occur. Between March and June 2026, ads linked to Discover-Tech were shown in over 70,000 mobile apps and more than 120,000 websites.
While not all ads from Discover-Tech were weaponized, the researchers noted that they observed ad impressions on networks linked to government and national security worldwide, including NATO and UN networks. Previous zero-click ad campaigns distributing spyware have been rare, but the researchers suggest this may be due to the extensive trust placed in ad infrastructure without oversight.
Marczak stated, "The network logs from Al Jazeera were key in understanding the ad-based nature of that attack." He emphasized that personal devices targeted while connected to home Wi-Fi or mobile data may not be monitored as closely, leading to a lack of visibility in prior reports. Jason Kint, CEO of Digital Content Next, expressed concern over the potential for zero-click attacks through ads, stating that anything undermining user trust in the open web is alarming.