The real-time bidding auctions that decide, in less than a second, which ad appears on a news site or inside a mobile app have been used to deliver mercenary spyware. Devices were infected simply because an ad loaded, with no click and no download.
Researchers at the University of Toronto’s Citizen Lab published the first technical proof of this method on October 15, 2026. They call it AdFection. An Israeli firm registered as an advertising company, Discover-Tech, acted as the bridge. It let spyware vendors profile millions of devices through normal ad bids and then push zero-click exploits to selected targets. The evidence points to infections at Al Jazeera. At least 45 devices belonging to the news outlet’s staff received Candiru spyware this way in 2024 and 2025.
The discovery lands like a warning shot across the advertising industry. For years experts suspected mercenary spyware firms experimented with ad-based delivery. Israeli outlets reported on concepts years ago. But concrete, public technical evidence stayed elusive until now, and the implications stretch beyond one campaign. Millions of devices touched infrastructure tied to these attacks. Ordinary users scrolling apps or reading articles became unwitting participants in large-scale profiling.
Discover-Tech presented itself as a standard player in digital marketing. It bid aggressively in real-time auctions. Yet its platform, called Controlium, offered clients something different. Precise targeting by mobile advertising ID, browser cookies or IP address. Once a match appeared, the system could fingerprint the device. If that device belonged to a person of interest, the ad response changed. Instead of a benign creative, it delivered code that reached out to Candiru’s servers. The connection happened silently. Next, a Candiru validator server checked the device before it was further profiled and infected.
Network logs from Al Jazeera showed a clear sequence: devices contacted Discover-Tech domains first, then a Candiru validator server, then Candiru command-and-control servers. The sequence repeated across multiple incidents. Forensic markers matched known Candiru behavior. The firm, which has rebranded as Integrity Labs, built a reputation for invasive tools sold to governments. Its products appear on lists of restricted entities in the United States.
But the operation reached further. Analysis of exposed bidding records from Discover-Tech’s own site revealed staggering volume. Between March and June 2026 the company placed 3.7 billion bids. It won roughly 442 million. Ads carrying the suspicious script tags ran in more than 70,000 mobile apps and on over 120,000 websites. They ran on news sites and weather apps, and even in language-learning and dating apps. The reach crossed dozens of countries. Government networks in Europe, North America and Asia saw the ads. Profiling, not confirmed infection, touched organizations linked to NATO, the European Commission, chipmakers and more.
Wolfie Christl, a senior researcher at Citizen Lab, captured the dread. “The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario.” His words appear in the Wired report that broke down the findings the same day. The story spread quickly. Ars Technica called it likely the first confirmation of mercenary spyware delivered by targeted ads. TechCrunch highlighted how governments could abuse global ad networks this way. The coverage painted a consistent picture. This was no proof of concept. It operated at scale for years.
Parallel work by ad security firm Confiant reinforced the findings. Their investigation examined traffic patterns and confirmed the same infrastructure. Both teams noted that Discover-Tech avoided sending obviously malicious code to the ad exchanges themselves. The exploit logic stayed hidden until the specific target rendered the ad. That design helped it evade automated scanners. Some exchanges received tags built to slip past checks.
Google listed Discover-Tech as a certified vendor until the disclosures. So did IAB Europe. Both organizations removed the firm after researchers shared their evidence. A Google statement obtained by multiple outlets confirmed it blocked the company for violating policies. The speed of the response suggests the findings carried weight. Yet the fact that an apparent spyware facilitator held approved status for years raises hard questions about vetting processes across the ad tech stack.
Candiru was not alone. Citizen Lab linked Discover-Tech’s platform to other players in the mercenary space. Bindecy, another Israeli outfit known for zero-click mobile exploits, appeared in the data. So did Intelos. Login records from an exposed Controlium endpoint included users the researchers tied to Candiru and Bindecy. The connections suggest a broader ecosystem where ad infrastructure serves as an on-ramp for surveillance tools.
Bill Marczak, another key researcher on the project, put it directly. “Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform.” His comment, reported in the Financial Post coverage of the Financial Times story, points to a systemic failure. Everyday digital experiences now carry hidden risks for journalists, activists, officials or anyone whose profile matches the interests of a spyware customer.
The Al Jazeera case stands out because the outlet cooperated with the investigation. Its security team provided logs and device data. The targeting spanned 2024 and 2025. Windows machines received the confirmed infections, though the technique works on iOS and Android too. Researchers stopped short of naming the government customer behind the operation. Attribution at that level remains difficult. But the pattern fits known government use of commercial spyware against media organizations critical of certain regimes.
So what does this mean for the rest of us? Ad blockers gain new relevance. They don’t just reduce annoyance or protect privacy in the traditional sense. They shrink the attack surface. Yet many organizations and individuals cannot avoid all ads. News sites depend on them. Apps rely on programmatic revenue. The entire real-time bidding system assumes participants act in good faith. That assumption now looks dangerously outdated.
Industry associations and big platforms face pressure to act. Stronger vetting of ad partners. Better behavioral analysis of bidding patterns. Shared threat intelligence on suspicious creative tags. Some of these steps are already happening in response to the report. But the mercenary spyware business adapts quickly. New intermediaries could emerge. Techniques might evolve to use different parts of the ad stack or legitimate-looking front companies.
Researchers emphasized one point repeatedly. This represents the first detailed public confirmation. Earlier hints existed. Haaretz reported in 2024 that Intellexa had developed a proof-of-concept system called Aladdin in 2022 to infect phones through targeted ads. But technical proof of real-world zero-click delivery through ads stayed missing. Citizen Lab and Confiant closed that gap with forensic detail, exposed bid logs and victim telemetry.
The researchers examined nearly four billion bidding records covering hundreds of millions of ad impressions across tens of thousands of apps and sites, and millions of devices were steered toward Candiru servers, likely for profiling. The infrastructure existed to support far more than the confirmed Al Jazeera cases. How many other targets received infections? How many governments bought access? Those questions linger.
Security teams at media organizations now review their ad suppliers with fresh urgency. Device management policies may tighten. Forensic tools that detect unusual connections to known spyware domains could see wider adoption. For ordinary users the advice sounds familiar yet newly urgent. Keep software updated. Consider ad blocking where practical. Recognize that the digital advertising machine, built to monetize attention, can also monetize surveillance.
The report arrives at a moment when mercenary spyware draws increasing scrutiny. Apple and Meta have sued vendors and pushed technical defenses. Governments debate export controls. Yet the tools proliferate. Zero-click methods remove the weakest link, the human who might spot a suspicious link. Ad-based delivery removes even the need for a message or email. The target simply uses their device normally.
And that changes the calculation. What once required expensive, closely held exploits and careful social engineering now piggybacks on infrastructure that reaches every smartphone and laptop. The barrier to entry drops. The potential victim pool expands. Defenders must rethink assumptions about safe browsing and trusted apps.
Citizen Lab researchers framed their work as both technical analysis and policy signal. Newsrooms worldwide should treat the findings as evidence of active targeting. Companies that run ad networks bear responsibility for who participates. Users deserve transparency about hidden risks in the sites and apps they rely on daily.
The story is still unfolding. Google’s removal of Discover-Tech and IAB Europe’s suspension of the firm from its vendor list mark one response. Further investigations may reveal additional campaigns or vendors. Spyware makers will likely adjust tactics. Citizen Lab says a separate report will detail another ad-intelligence vendor, which it calls DARK CARTOGRAPHER.