Online adverts can do more than track people's browsing habits. Researchers have uncovered how targeted advertising was used to install spyware on devices without victims clicking anything.
The investigation, published by the University of Toronto's Citizen Lab on 15 October 2026, linked Israeli advertising technology company Discover-Tech to attacks targeting at least 45 devices at news organisation Al Jazeera.
Researchers traced the attacks to spyware developed by Israeli company Candiru, now known as Integrity Labs. Their findings show how advertising systems designed to profile consumers can also be exploited to deliver malicious code to selected devices.
How Online Ads Became a Spyware Delivery System
Citizen Lab calls the technique 'AdFection'. It exploits automated advertising auctions that determine which adverts appear when someone opens a website or mobile app.
These auctions take place in fractions of a second.
Advertisers may receive information about users, including device identifiers, IP addresses and location data. Such details can help identify individuals and determine which adverts they receive.
According to Citizen Lab, Discover-Tech placed adverts containing code that contacted its servers whenever an advert loaded. The servers could identify a device and determine whether to return additional JavaScript instructions.
Most devices received no additional executable code, although the adverts could still collect tracking information.
Selected targets could receive malicious code designed to exploit security vulnerabilities and install spyware. No click was necessary, and the advert could load without the victim noticing.
Al Jazeera Devices Targeted in Zero-Click Spyware Attacks
Citizen Lab identified attacks targeting at least 45 devices at Al Jazeera during 2024 and 2025.
Researchers linked the activity to Candiru with high confidence and confirmed that some devices were infected through targeted advertising. The findings do not establish that all 45 targeted devices were infected.
Network records provided by Al Jazeera helped investigators reconstruct the attacks. Infected devices first contacted Discover-Tech's advertising infrastructure before connecting to servers associated with Candiru.
Al Jazeera also isolated a Windows DLL file from one compromised device.
Its embedded command-and-control server addresses matched infrastructure identified by the researchers. Citizen Lab described the investigation as the first public technical confirmation of commercial zero-click spyware infections delivered through targeted advertising.
The findings raise particular concerns for journalists, whose devices may contain confidential sources, private communications and sensitive documents. Unlike phishing attacks, this technique does not require victims to open suspicious attachments or click unfamiliar links.
Millions of Devices Exposed to Advertising-Based Surveillance
The operation extended far beyond the documented attacks at Al Jazeera.
Citizen Lab examined nearly four billion advertising bidding records from March to June 2026. Discover-Tech's advertising system submitted approximately 3.77 billion bids and appeared to win nearly 442 million.
Adverts containing attacker-linked scripts appeared across more than 120,000 websites and 75,000 mobile applications. These figures reflect advertising activity, not confirmed spyware infections.
Researchers also found that Discover-Tech's adverts directed millions of devices to contact servers associated with Candiru, likely for large-scale tracking and reconnaissance. However, this does not establish that those devices were infected with spyware.
A parallel investigation by cybersecurity company Confiant examined the advertising infrastructure and its surveillance capabilities.
Citizen Lab also identified advertising impressions on networks associated with NATO, United Nations bodies and government organisations. An advert appearing on a network, however, does not prove that its devices were compromised.
Google Cuts Access as Advertising Industry Faces Questions
Discover-Tech's participation in major advertising platforms has raised questions about how companies are screened before gaining access to advertising networks.
Citizen Lab found that Discover-Tech appeared on Google's certified or approved advertising vendor lists and IAB Europe's vendor registry between 2020 and 2026. Researchers said these listings helped the company participate in the advertising ecosystem at scale.
Following the investigation, Google terminated Discover-Tech's access to its advertising exchanges in early October 2026.
IAB Europe removed the company from its vendor registry. Beeswax also removed its access, Vungle suspended access pending a review, and Eskimi blocked its accounts and domains. Citizen Lab said Discover-Tech and Candiru did not respond to requests for comment within the specified deadline.
Citizen Lab called for stronger screening, independent audits and regulatory oversight.
The researchers warned that advertising systems allowing third parties to execute code inside websites and apps create opportunities for surveillance and exploitation.
Can You Protect Yourself From Zero-Click Spyware?
The findings do not mean every online advert is dangerous or that millions of people have been infected. The documented attacks involved selected targets, while the wider advertising activity included tracking and suspected reconnaissance.
Citizen Lab identified blocking targeted advertising as an important defence against similar attacks.
Trusted ad blockers and network-level filtering may reduce exposure. Disabling ad tracking, resetting mobile advertising IDs and using privacy-focused browsers can also help limit the information available to advertisers.
Keeping operating systems, browsers and applications updated remains an important security precaution. However, updates cannot guarantee protection against previously unknown vulnerabilities.
Journalists, human rights defenders and others facing heightened surveillance risks may need specialist security advice.
The investigation exposes a threat beyond unwanted personalised advertising. Systems that collect information about people's online activities can also help attackers identify targets and deliver spyware without warning.
