Citizen Lab Says Israeli Ad Firm Delivered Zero-Click Spyware to 45 Al Jazeera Devices

A zero-click spyware attack does not need you to click anything. According to a report published today, Oct. 15, by the University of Toronto's Citizen Lab, it may only need you to load a page that shows an ad.

Citizen Lab calls the technique AdFection. It says the report, Citizen Lab Report 195, is the first public technical confirmation of mercenary spyware delivered through targeted online advertising.

What Citizen Lab says happened at Al Jazeera

At least 45 devices at the news network Al Jazeera were infected in 2024 and 2025, the researchers say. Reporting on the findings describes the machines as Windows computers. Al Jazeera shared network logs with the researchers, which they used to reconstruct the attacks.

The spyware came from Candiru, which Citizen Lab says has rebranded as "Integrity Labs." The ads that delivered it were purchased by Discover-Tech, a Tel Aviv company that markets itself as a legitimate advertiser.

The researchers say infected devices contacted Discover-Tech domains and then connected to infrastructure tied to Candiru. Citizen Lab says it is not clear which governments were behind the attacks.

Confirmed infections of phones have not been established for this campaign. Discover-Tech's ads ran on Android and iOS apps, which shows potential mobile exposure but not proven compromise.

How the system works

Programmatic advertising sells ad space automatically, in milliseconds, every time a page or app loads. Advertisers bid based on targeting data about the device and the person using it.

Citizen Lab says Discover-Tech ran a platform called Controlium that used this process to fingerprint and de-anonymize a device when an ad rendered. It then checked whether the device matched a chosen target. If it did, the device was quietly steered toward Candiru's servers, where an exploit could be served.

Everyone else got a harmless ad. That conditional delivery makes the operation hard for ad reviewers and researchers to catch.

The researchers say Controlium left some of its source code exposed on its login pages. That let them recreate its web-based control panel without logging in.

Scale beyond Al Jazeera

Citizen Lab analyzed four billion Discover-Tech bidding records. In a four-month window, it says, the company's ads appeared on almost 200,000 unique websites and apps across dozens of countries.

Those ads also covertly sent millions of devices to contact Candiru's servers. Citizen Lab says the likely purpose was large-scale tracking and reconnaissance.

Confiant, the U.S. ad security firm that ran a parallel investigation, says Discover-Tech ads also appeared on sensitive networks. Those include the U.S. Department of Defense, NATO, the International Atomic Energy Agency and cybersecurity agencies in several countries. Confiant says it first flagged a suspicious ad creative on April 12, 2026. Its data window runs from April 1 through Sept. 10, 2026.

Citizen Lab also ties Discover-Tech to other surveillance vendors, including Bindecy and Intelos. It describes a separate actor it calls DARK CARTOGRAPHER, which uses Discover-Tech infrastructure to exploit mobile carrier vulnerabilities and link advertising IDs to phone numbers. CyberScoop reports that this activity dates to 2019 and involves other vendors, including an unnamed U.S. intelligence contractor. Citizen Lab says it will publish those findings separately.

The company's own pitch

Discover-Tech's website says: "We take pride in providing our clients with a gateway to global fraud-free traffic, connecting your brand with real users." Citizen Lab's report says the company ran a separate program that let spyware makers inject malicious software onto visitors' devices.

Calls for action

The researchers say the failure ran through the whole ad supply chain. Wolfie Christl, a senior Citizen Lab researcher, called it "disastrous" that ad vendors failed to detect the operation for years. "Digital advertising is broken," he said, adding that cybersecurity agencies, regulators and lawmakers in the U.S., Europe and elsewhere "must urgently step in."

Bill Marczak, a senior Citizen Lab researcher, said a person hacked this way "would not see anything amiss. In fact, they might not even see any ad at all." Christl called the risk "a nightmare scenario."

Jerome Dangu, chief technology officer and co-founder of Confiant, said the industry has "optimized against cyber criminals, scams and malware for profit" but not against surveillance. He said it has "a lot of rethinking to do."

Natalia Krapiva of the digital rights group Access Now, who read the report but was not involved in the research, said states and tech companies whose infrastructure is used in such attacks "need to take urgent technical, legal and regulatory measures."

The personal defense is thin. Marczak says the main protection is blocking ads as thoroughly as possible on every site and platform. Citizen Lab's report includes a recommendations section aimed at stopping AdFection attacks.

Open questions

The government customers are the biggest unknown. Spyware like Candiru's is typically leased to state clients, and the researchers have not identified who paid for the Al Jazeera operation. The same question applies to the unnamed U.S. intelligence contractor in the DARK CARTOGRAPHER findings.

The report's call for investigations and sanctions is now with regulators and lawmakers. Citizen Lab has also promised a second report on DARK CARTOGRAPHER and the mobile carrier exploits behind it.