Targeted online advertisements were used to install mercenary spyware without a tap or a link, according to parallel investigations published Thursday by the University of Toronto’s Citizen Lab and New York ad-security firm Confiant. The researchers tie the pipeline to Discover-Tech, an Israel-based ad broker they say connected major ad exchanges to Candiru, a spyware maker now operating under the Integrity Labs brand.
What the reports allege
Citizen Lab said it is the first public technical confirmation of zero-click mercenary spyware delivered through targeted ads, a technique the lab calls “AdFection.” Using network forensics and implant analysis, researchers linked Discover-Tech infrastructure to infections on 45 devices at the international news network Al Jazeera during 2024 and 2025.
Confiant, which began blocking suspicious Discover-Tech inventory in April, described the same operator as weaponizing commercial ad infrastructure for staging, micro-targeting and payload delivery. The firm said campaign volumes were deliberately tiny—hundreds to low thousands of impressions per day—across nine countries including Belgium, the United Arab Emirates and Saudi Arabia, consistent with surgical targeting rather than mass fraud.
How ads became an attack channel
Under the model outlined in both reports, Discover-Tech’s Controlium platform and related “NOAS/getAd” servers served ads that looked like ordinary programmatic placements on major supply paths, including inventory that passed through Google and Beeswax before industry takedowns. For users who matched a customer’s profile, the ad’s JavaScript contacted validator and command-and-control infrastructure associated with Candiru, enabling a zero-click exploit chain on iOS and Android devices, Citizen Lab said.
Confiant added that the ad code also vacuumed publisher cookies and session data at scale, turning the open web’s identity graph into a reconnaissance layer. Citizen Lab said it reviewed more than four billion ad records tied to Discover-Tech activity between March 2020 and March 2026, spanning tens of thousands of mobile apps and more than 120,000 websites, with impressions appearing on media organizations worldwide.
Industry and government response
Candiru has been on the U.S. Commerce Department entity list since 2021 for spyware used against officials, journalists and activists. Citizen Lab said Discover-Tech’s platform also connected to other mercenary vendors named in the research, including mobile exploit firm Bindecy and geolocation contractor Intelos.
Confiant said it coordinated disclosure so major ad platforms could cut Discover-Tech’s access, and reporting from Anadolu and other outlets noted that Google, Beeswax and industry bodies moved to suspend the company once the evidence was shared. Discover-Tech had marketed itself as a legitimate broker; the researchers argue that brokering spyware delivery was its core business.
What comes next
Neither report names the government clients behind the Al Jazeera infections, but the findings raise fresh questions about how ad-tech data—device IDs, IP addresses, browsing history—can be repurposed for surveillance without touching a phishing inbox. Citizen Lab urged publishers and exchanges to treat high-risk ad code as a national-security surface, not only a fraud problem.
For newsrooms and NGOs, the lesson is blunt: the same targeting tools that sell sneakers can, in these cases, decide who gets hacked. Defenders who rely on user training alone may miss attacks that never ask the victim to click.