An advert for a pair of headphones or a mobile phone should not put your computer at risk of being hacked. But researchers say an Israeli advertising technology company helped surveillance firms exploit online adverts to track people and deliver spyware, potentially without victims clicking a single link.
An investigation by the University of Toronto's Citizen Lab and advertising security company Confiant has uncovered a network connecting Israeli firm Discover-Tech to spyware vendors, including Candiru.
The researchers say the operation used the global advertising ecosystem to identify targets, profile their devices and, in some cases, deliver malicious code through advertisements.
The findings, published on 15 October, provide what Citizen Lab describes as the first public technical confirmation of mercenary spyware being delivered through targeted advertisements in real-world attacks without requiring users to click on them.
The technique, which the researchers call 'AdFection', raises fresh questions about whether the digital advertising systems used across thousands of websites and apps can be abused to facilitate surveillance.
How Online Ads Were Allegedly Used to Deliver Spyware
Discover-Tech presented itself as a conventional digital advertising business. According to the researchers, however, its platform also provided a way for spyware companies to identify and target specific devices through online advertising.
The company operated a platform called Controlium, which researchers say enabled surveillance partners to profile users, link identifiers across advertising networks and select potential targets for tracking or infection.
The process exploited the way online advertising works. When someone opens a website or app, advertising systems conduct automated auctions to decide which advert appears on the screen. These transactions can expose information such as advertising identifiers and other technical details about a device.
Citizen Lab said Discover-Tech's infrastructure could use information from these transactions to identify devices of interest. If a device was selected as a target, the advertising process could trigger the delivery of malicious code designed to exploit vulnerabilities.
In a zero-click attack, the victim does not have to open a suspicious attachment, tap a link or download an obvious malicious file. The attack can take place when an advert is displayed, although successful infection depends on the relevant targeting and technical conditions being met.
This makes the technique particularly concerning: users may have little reason to suspect that an ordinary advert is connected to a surveillance operation.
Al Jazeera Devices Were Targeted Through Malicious Ads
One of the most significant findings concerns devices belonging to Al Jazeera, the Qatar-based international news organisation.
Citizen Lab said it confirmed that at least 45 Windows devices at the broadcaster were compromised with spyware associated with Candiru between 2024 and 2025. The researchers based their findings on technical evidence, including network logs shared with them.
The investigation linked the infections to malicious advertisements purchased through Discover-Tech's advertising infrastructure.
The researchers also found evidence that Discover-Tech's adverts appeared across websites and apps associated with sensitive organisations, including government institutions, international bodies and technology companies.
However, the appearance of an advert on a particular organisation's network does not establish that the device was infected. The researchers distinguished between evidence of widespread advertising exposure and confirmed cases of compromise.
The findings also do not establish which government, if any, directed each operation. The researchers said the evidence connected the advertising infrastructure to spyware vendors, but the identity of the ultimate operators behind particular attacks remains uncertain.
Thousands of Websites and Apps Were Part of the Advertising Network
The scale of Discover-Tech's advertising activity was another concern. Citizen Lab analysed almost four billion advertising-bidding records that had been publicly exposed through the company's infrastructure. The records showed that Discover-Tech advertisements appeared on more than 120,000 websites and over 70,000 mobile apps between March and June 2026.
Reuters reported that the company's adverts reached more than 120,000 websites and 75,000 apps through its various partnerships.
The researchers said the operation used connections to advertising platforms including Google, Yandex and Comcast-owned Beeswax. This provided access to a broad ecosystem through which adverts could be delivered to users across different services.
The findings suggest that the same infrastructure used to target consumers with commercial advertising can potentially be repurposed to identify people of interest to surveillance operators.
The researchers warned that the problem extends beyond a single company. The global advertising ecosystem was designed to distribute targeted messages at scale, but the identifiers and automated systems involved can also create opportunities for profiling and abuse.
Google and Advertising Platforms Take Action
Following the investigation, several companies and industry organisations took action against Discover-Tech.
Citizen Lab said Google terminated the company's access to its advertising exchange platforms. Comcast-owned Beeswax removed Discover-Tech from its ad-buying platform, while advertising technology provider Vungle, operated by Liftoff, paused its access pending a review.
IAB Europe also removed the company from its list of approved advertising vendors. Eskimi blocked its accounts and domains, according to the researchers.
Discover-Tech did not respond to requests for comment from Reuters, while the researchers and media reports said attempts to contact the company and relevant spyware operators had been unsuccessful.
The actions by advertising platforms highlight the role intermediaries can play in limiting the distribution of malicious advertising. However, removing a company from particular networks does not by itself establish that all associated infrastructure or potential threats have disappeared.
What Can Users Do to Reduce the Risk?
The investigation does not mean that every online advert is dangerous or that everyone who saw a Discover-Tech advertisement had their device compromised.
Nevertheless, researchers say the findings illustrate how advertising technology can be exploited in ways that are difficult for ordinary users to detect.
Citizen Lab advised people who may be at elevated risk of targeted surveillance to consider disabling advertising tracking and using ad blockers. Keeping operating systems, browsers and apps updated is also important because security updates can address vulnerabilities exploited by attackers.
Users who believe they may be targeted because of their work, access to sensitive information or public profile should consider specialist digital security advice rather than relying on a single protective measure.
For organisations, the findings raise questions about the security of third-party advertising systems and the extent to which they can verify the activities of companies participating in their networks.
The investigation exposes a troubling possibility: the infrastructure that makes online advertising ubiquitous can also provide a route for covert surveillance. When an attack can be triggered by an advert appearing on a screen, spotting a suspicious link may no longer be enough to understand the risk.
