Spyware Makers Turned Your Ad Auction Into a Zero-Click Hack

 

By TechPulse USA Newsroom — October 17, 2026

The ad you scrolled past this morning wasn't selling you anything. It may have been checking whether you were worth hacking. On Thursday, researchers at the University of Toronto's Citizen Lab published the first technical proof of a nightmare the security world had only whispered about: mercenary spyware — the kind governments buy to raid journalists' phones — can now arrive inside an ordinary online ad. No click. No download. Not even a visible banner. They call it AdFection, and frankly, the advertising industry has run out of excuses.

The report, Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware, names the company at the centre of it: Discover-Tech, an Israeli firm that spent six years posing as a legitimate digital advertising business. Citizen Lab says it found no evidence the company ever did any real advertising at all. Its actual business, the researchers write, was acting as a bridge between the ad market and the spyware trade. We checked Citizen Lab's public report page again on October 17 — the findings stand as published, with no retraction or correction posted.

How an Ad Became a Hack

Here's how the trick works, and it's worth understanding, because the same machinery is running on your phone right now. Every time an app or a webpage shows you an ad, that slot is auctioned off in under a second. Bidders in the auction get a packet of data about your device — your advertising ID, your IP address, which app or site you're on. That's the plumbing of modern programmatic advertising, and it's supposed to serve you a better shoe ad.

A diagram of programmatic ad auctions — advertiser, DSP, ad exchange, SSP, publisher. Citizen Lab says Discover-Tech hid its spyware pipeline inside exactly this machinery. (Image: Carlos Diaz Ruiz, CC BY 4.0, via Wikimedia Commons)

Discover-Tech's ads carried a tiny piece of code that, the moment the ad rendered, quietly sent your device's advertising ID and IP address back to a Discover-Tech server. That server then made a decision: are you a target? If yes, it sent back malicious JavaScript for your browser or app to run — a zero-click exploit that handed your device to Candiru's spyware. If no, the server sent back nothing at all. That's the diabolical part. Because the ad itself contained no attack code, the ad networks' scanners saw a perfectly benign creative. In some cases, the ad didn't even need to be visible — it loaded in the background, out of sight, and did its work anyway.

"There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," Bill Marczak, a senior researcher at Citizen Lab, told TechCrunch ahead of the report's release. It's a different delivery system from the self-replicating AI worms Anthropic's own researchers now say are months away — but the logic is the same: infection with no human in the loop.

The Company That Sold Spyware Disguised as Advertising

Discover-Tech, registered in Israel in 2020 and led by chief executive Dekel Boni, looked like any other demand-side platform. Its customers logged into a web panel called Controlium, where they could pick targets by mobile advertising ID, browser cookie, or IP address. The control panel itself was a small marvel of carelessness: Citizen Lab found its source code exposed on its own login pages, letting the researchers recreate the dashboard without ever signing in. Worse, a public corner of the site leaked reams of Controlium login records — including credentials belonging to employees of Candiru, the spyware maker, and operators from Bindecy, a second vendor specialising in zero-click mobile exploits, logging in from several European countries and Singapore.

The corporate family tree is pure spyware-industry. Board director Eric Banoun joined in 2020 and stayed until 2025; he co-founded the surveillance firms Circles and Senpai Technologies, both closely tied to NSO Group and Intellexa. A shareholder was linked to Sara Hamou, who managed Intellexa's corporate network and was sentenced to eight years by a Greek court over a spyware-abuse scandal, pending appeal. "Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform," Marczak told the Financial Times.

Candiru itself is no newcomer. The United States put it on a trade blacklist in 2021 over spyware used against government officials, journalists and activists. It has since rebranded as Integrity Labs — its assets were bought last year by a US investment firm, Integrity Partners — a corporate shape-shifting the sanctions were not built to stop. Both firms declined to comment.

45 Devices, One Newsroom: What Happened at Al Jazeera

The part of the report that will follow Discover-Tech forever happened at Al Jazeera. The broadcaster's own technology team noticed something odd on devices used by its journalists in 2024 — "unusual patterns," in the network's telling — and asked Citizen Lab to dig. What came back was the first confirmed kill chain of its kind: at least 45 Windows devices infected with Candiru spyware in 2024 and 2025, delivered through poisoned ads.

Al Jazeera's newsroom at its Doha headquarters — file photo. At least 45 Windows devices used by the broadcaster's staff were infected with Candiru spyware through poisoned ads in 2024 and 2025. (Photo: Wittylama, CC BY-SA 3.0, via Wikimedia Commons)

The evidence is unusually tidy. Network logs showed the same three-step sequence every time: first contact with a Discover-Tech ad server, then a Candiru validation server that screened the device, then a command-and-control server. The researchers recovered an actual Windows DLL from one compromised machine, and its code shared distinctive techniques with a Candiru tool Citizen Lab had dissected back in 2021. Al Jazeera reported the particular tool used is understood to have cost several million dollars.

This wasn't the newsroom's first ride. In 2020, dozens of Al Jazeera journalists' iPhones were hacked with NSO Group's Pegasus spyware. The network said Thursday it "condemns the spyware attacks targeting a number of its staff," called the targeting of journalists an "assault on press freedom," and pledged to protect its people. It's hard not to notice the grim pattern: a newsroom that investigates power keeps getting its own devices turned into the investigators' notebooks.

The Blast Radius: NATO, the Pentagon, and Your Phone

If the Al Jazeera infections are the smoking gun, the rest of the data is the arsenal. Citizen Lab reviewed nearly four billion bid records from Discover-Tech's systems, covering March to June 2026. The numbers are staggering: about 3.77 billion bids placed, roughly 442 million auctions won, ads appearing in 75,373 mobile apps and 120,768 websites. Confiant, the ad-security firm that ran a parallel investigation, counted roughly 10 million Discover-Tech impressions a day across 228 countries.

And where did those ads land? On the networks of NATO and the United Nations. The European Parliament and the European Commission. Norway's legislature and police, Sweden's armed forces, Denmark's rail and postal networks. Australia's nuclear science agency. Chip giants Intel, Nvidia, Sandisk, Broadcom, Micron and ARM. Apple, Microsoft, Raytheon, Elbit Systems. Confiant separately found Discover-Tech ads on networks used by the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Citizen Lab is scrupulous about the caveat — an ad impression is not an infection, and most people who saw these ads were never targeted. But every impression was a profiling event, and the reach shows how completely the system could be pointed anywhere.

One quote from the week will stick. Jerome Dangu, the co-founder of Confiant, told Reuters that some regions were saturated by Discover-Tech's ads — particularly the Palestinian territories.

"You go to almost any site in Palestine — any site — you find a Discover-Tech ad," he said. "It gives them a very complete visibility on the digital activities of an entire country." His broader estimate: "Very likely hundreds of millions of people would have been touched by Discover-Tech." There's also a darker footnote the researchers are saving for later: a separate actor, tracked as DARK CARTOGRAPHER, used Discover-Tech's infrastructure to link mobile advertising IDs to phone numbers in more than 30 countries. A follow-up report is coming. The one thing Citizen Lab will not do is name the governments behind any of this — it says it can't attribute the attacks, and unlike a lot of the commentary this week, it refuses to guess.

Google and the Ad Industry Finally Pulled the Plug

After the researchers shared their findings, the industry moved — fast, and far too late. Google removed Discover-Tech from its vendor lists and terminated its access to its ad systems, saying the company was blocked "for systematically violating our policies." IAB Europe suspended it after an audit found policy violations. Beeswax cut it off too; Vungle paused its access pending review; Eskimi blocked its accounts and domains.

The uncomfortable question is how it took this long. Discover-Tech sat on Google's and IAB Europe's approved-vendor lists from 2020 until this month — six years of certification while, according to Citizen Lab, it did essentially no legitimate advertising and instead built a spyware pipeline. That's the same pattern we keep seeing: the industry's vetting keeps failing exactly where it matters most, and the failure only gets noticed after independent researchers do the work the platforms were paid to do. On the day the findings landed, Discover-Tech's website was still online — and still saying nothing, Reuters noted. Candiru's new owners, Bindecy and Yandex all declined or ignored requests for comment.

AdFection FAQ: the questions everyone's asking

What is AdFection? It is Citizen Lab's name for the first publicly confirmed zero-click mercenary-spyware attack delivered through targeted ads, published in the lab's October 15 report.

Do you have to click anything to be infected? No. As the report puts it, "the ad itself contained no attack code" — and Citizen Lab's Bill Marczak told WIRED that a person could be hacked without ever seeing the ad at all.

Which government was behind the targeting? Unknown — and that is Citizen Lab's position, not a gap in the reporting. The lab refuses to attribute the operation, and this post keeps that stance: do not speculate.

Can regular ad blockers protect me? They reduce exposure — Citizen Lab's own guidance recommends blocking ads at the network gateway — but they are not confirmed as a tested defence against AdFection specifically.

What This Means — and What You Can Actually Do

Here's our judgment, and we'll be blunt: the ad-tech industry's business model is the vulnerability. Real-time bidding was designed to broadcast your device's identifiers to hundreds of strangers in milliseconds, and Citizen Lab's Wolfie Christl said the quiet part out loud to Reuters: "The way online advertising works today is a systemic security threat." The shoddiest part of this story isn't even the spyware — it's the certification. A company with board members from the NSO orbit, no legitimate ad business, and a control panel that leaked its own logins got to ride Google's approved-vendor lists for six years. That's not a loophole. That's due diligence theatre.

So what can you actually do? Marczak's advice is stark: "If you might be targeted based on who you are or what you do, it's time to disable ad tracking on your devices or even block ads altogether." Citizen Lab's formal guidance goes further — block ads at the network gateway, reset and disable your mobile advertising ID, use privacy-respecting browsers, and for organisations, treat gateway ad-blocking as a cybersecurity basic rather than an IT nicety. As John Scott-Railton, another of the report's authors, put it on X: "A normal-looking ad loads. If you're a target, you're infected. No click needed. ... To protect yourself, block ads now."

Regulators, take note: this is the same territory where the FTC just slapped OpenAI and Anthropic with 50 pages of demands — but ad-tech spyware is a harder target, because the entire industry's revenue depends on the exact data flows the attackers abused. Citizen Lab calls Discover-Tech "surely just the tip of the iceberg," in Marczak's words, and nothing in the industry's track record suggests otherwise. The next Discover-Tech is already bidding.

Update, Oct. 18

One more detail sharpens the “zero-click” claim beyond what we reported yesterday: Bill Marczak told WIRED that a target could be hacked without ever seeing the ad at all, according to NeoTeo’s October 16 write-up citing WIRED. And the story is not over — Citizen Lab says a separate report on DARK CARTOGRAPHER, the actor using Discover-Tech infrastructure to link mobile ad IDs to phone numbers in more than 30 countries, is still forthcoming, with no announced date.

Sources: The Citizen Lab's "Exposing AdFection" report and executive summary (Oct 15, 2026); Confiant's co-timed investigation; reporting by Reuters, TechCrunch, Al Jazeera, The Hacker News, CyberInsider and Engadget.

TechPulse USA's cybersecurity desk covers the firms, tools and governments shaping digital conflict — from spyware vendors to the regulators chasing them.