Science & Tech · Cybersecurity · 46 mins ago
Researchers say online ads enabled zero-click spyware attacks
Researchers say Israeli ad agency Discover-Tech used online ads to enable spyware attacks without people clicking on anything.
The ads appeared across websites and apps, and could identify and track users when they loaded.
Citizen Lab said at least 45 devices at Qatar-based Al Jazeera were compromised between 2024 and 2025, with spyware linked to Israeli company Candiru.
The spyware can steal messages, photos and emails and secretly access a device’s microphone, researchers said.
The findings show how ordinary advertising can become a tool for surveillance, including in sensitive government and international networks.
Google ended Discover-Tech’s access to its ad platforms, and IAB Europe removed it from its vendor list.
Researchers say regulators and lawmakers should investigate the companies involved and address the risks in online advertising.
Researchers said Israeli advertising firm Discover-Tech used targeted online ads to track users and help deliver spyware without requiring them to click.
The Citizen Lab and Confiant linked some ads to Candiru spyware and reported that at least 45 Al Jazeera devices were targeted between 2024 and 2025.
Discover-Tech ads appeared on more than 120,000 websites and over 70,000 mobile apps, according to the researchers.
Google blocked Discover-Tech from its ad platforms, and IAB Europe removed it from its vendor list.
Researchers said the operation exposed security risks in the online advertising system.
- Who
- Israeli advertising firm Discover-Tech, with ads linked by researchers to spyware firms including Candiru.
- What
- Researchers said targeted ads tracked users and helped deliver zero-click spyware.
- When
- The research was reported on October 15, 2026; Al Jazeera devices were targeted between 2024 and 2025.
- Where
- Online ads appeared on websites and apps worldwide, including networks used by Al Jazeera.
- Why
- Researchers said the likely goal was large-scale tracking and surveillance.
This story does not have two clearly opposing sides.
Activities by a group researchers dubbed DARK CARTOGRAPHER, involving Discover-Tech and other vendors, date back to this year.
Discover-Tech was founded.
The US Commerce Department blacklisted Candiru.
Citizen Lab said 45 Al Jazeera devices were targeted in zero-click attacks linked to Candiru spyware delivered through Discover-Tech ads.
Researchers publicly reported details of the targeted-ad spyware operation.
- Discover-Tech ad reach
- More than 120,000 websites and over 70,000 mobile apps
- Al Jazeera devices
- At least 45 targeted between 2024 and 2025
- Candiru blacklisting
- US Commerce Department, 2021
- Discover-Tech response
- Did not return messages seeking comment
- Google action
- Blocked Discover-Tech from its ad platforms
7 sources
CitizenLab details new spyware triggered by online advertising
Israeli firm’s digital ads enabling installation of ‘zero-click’ spyware, researchers say
Israeli firm used online ads to run vast spy operation, researchers say
New ‘zero-click’ spyware hacked phones using targeted ads
Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware
‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads
AdFection: How mercenary spyware invades victims’ devices through targeted advertising
What people are saying
The way online advertising works today is a systemic security threat
Very likely hundreds of millions of people would have been touched by Discover-Tech
Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all.
Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies.