started · updated
Discover-Tech used online ads to deliver zero-click spyware
Research from Citizen Lab and cybersecurity firm Confiant has documented a sophisticated cyber espionage campaign, termed ‘AdFection’, which uses targeted digital advertisements to deliver mercenary spyware via zero-click exploits. The operation involved the Israeli firm Discover-Tech, which operated the Controlium platform to broker relationships between spyware developers and advertisers.
Between March and June 2026, malicious advertisements were displayed across more than 70,000 mobile applications and 120,000 websites. The campaign allowed for the infection of devices at the moment an advertisement was rendered, requiring no user interaction such as clicking a link. The spyware used in these attacks has been attributed to Candiru, an Israeli firm blacklisted by the United States government.
At least 45 devices belonging to staff at the international news organization Al Jazeera were targeted during 2024 and 2025. The research also indicated that Discover-Tech ads reached various high-profile entities, including NATO, the United Nations, the European Parliament, and several ministries of defense. While the ads reached millions of users globally, researchers noted that the mere display of an ad may indicate profiling even if an infection did not occur.
Entities
Al Jazeera · Candiru · Citizen Lab · Confiant · Discover-Tech · Google · University of Toronto
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 9 SOURCES] At least 45 devices at Al Jazeera were targeted during 2024 and 2025. www.businesstechweekly.com · www.it-daily.net · novaramedia.com · weekly.ascii.jp · atitudinea.ro · +4 more
- [● 9 SOURCES] The spyware infection requires no user interaction to be installed. blog.unkreativ.net · www.businesstechweekly.com · www.it-daily.net · novaramedia.com · weekly.ascii.jp · +4 more
- [● 9 SOURCES] The spyware used is attributed to the Israeli manufacturer Candiru. www.businesstechweekly.com · www.it-daily.net · novaramedia.com · weekly.ascii.jp · atitudinea.ro · +4 more
- [● 3 SOURCES] The attack technique is called AdFection. www.it-daily.net · weekly.ascii.jp · rocketnews.com
- [● 4 SOURCES] Discover-Tech ads were displayed in over 70,000 mobile apps and 120,000 websites between March and June 2026. novaramedia.com · atitudinea.ro · lajornadasanluis.com.mx · rocketnews.com
- [● 2 SOURCES] Google and IAB Europe approved Discover-Tech as a vendor until early October 2026. www.businesstechweekly.com · rocketnews.com
- [● 8 SOURCES] Citizen Lab documented the first technical case of mercenary spyware reaching devices via targeted advertising. blog.unkreativ.net · www.businesstechweekly.com · www.it-daily.net · novaramedia.com · weekly.ascii.jp · +3 more
- [● 5 SOURCES] Discover-Tech is an Israeli firm that operates the Controlium platform. blog.unkreativ.net · www.it-daily.net · novaramedia.com · atitudinea.ro · www.karar.com