Researchers Say an Israeli Ad Firm Google Approved Used Online Ads to Hit Al Jazeera With Zero-Click Spyware

Security researchers have warned for years that an online ad could be turned into a weapon. Now there is proof. An ad you never click, and may never even see, can install government-grade spyware on your device.

The Citizen Lab at the University of Toronto, working with ad security firm Confiant, published research on Thursday it calls "AdFection." It is the first detailed technical evidence of zero-click mercenary spyware delivered through targeted advertising.

How an ad becomes a hack

At the center is Discover-Tech, an Israeli company that presents itself as a legitimate ad firm. Citizen Lab describes it as a "bridge between ad vendors and the mercenary spyware ecosystem," and the report goes further: "In fact, it appears that serving as this bridge is Discover-Tech's primary purpose."

Its platform, Controlium, lets partners "de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered," CyberScoop reported. It abuses real-time bidding, the automated auction that decides which ad you see and hands advertisers device and location data along the way. Partners can pick a target by IP address, mobile ad ID or browser identifier.

"Someone who gets hacked like this would not see anything amiss," said Bill Marczak, a senior researcher at Citizen Lab. "In fact, they might not even see any ad at all."

Al Jazeera in the crosshairs

In 2024 and 2025, at least 45 devices at Al Jazeera were targeted with zero-click attacks that Citizen Lab links with high confidence to Candiru spyware delivered through Discover-Tech ads. Some were infected. Al Jazeera shared network logs, and infected devices contacted Discover-Tech domains before reaching out to Candiru infrastructure.

Candiru is an Israeli spyware maker the US government blacklisted in 2021. Its tools can take over a device, steal data and switch on the microphone and camera. Citizen Lab cannot attribute the attacks to any specific government or party.

Discover-Tech was not careful about hiding its tracks. It left source code exposed on login pages, along with a public section of Controlium login records that included logins from at least two Candiru employees and some from hacking firm Bindecy, according to TechCrunch.

Approved, vetted and everywhere

Here is the part that should worry everyone in adtech. Google and IAB Europe had listed Discover-Tech as an approved vendor since 2020, The Register reported. It has been facilitating mercenary spyware since at least 2024.

Its reach was enormous. Discover-Tech ads appeared in more than 70,000 apps and 120,000 websites between March and June 2026, according to nearly four billion ad-bidding records the company left exposed on its own website. Its ads directed millions of devices to Candiru-linked servers, though that does not mean those devices were infected.

Ad impressions also reached networks at NATO, the United Nations, the European Parliament, the European Commission, the Council of the EU, the US Department of Defense and the International Atomic Energy Agency, plus armed forces and agencies in Norway and Sweden. There is no evidence those organizations were infected, but the ads could profile devices on their networks. "The possibility that EU institutions have been exposed should set off alarm bells across Brussels," German Green MEP Hannah Neumann told Politico.

Citizen Lab researcher Wolfie Christl called it "disastrous" that ad vendors failed to spot this for years. "Digital advertising is broken," he said. "The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike." He wants regulators and lawmakers in the US, Europe and elsewhere to "urgently step in."

Confiant CTO Jerome Dangu explained the blind spot: "The industry has optimized against cyber criminals, scams and malware for profit that targets people for extracting money, but not for surveillance." The US military has already moved to disable ad trackers on troops' devices.

The fallout

Google said it "blocked Discover-Tech from our ad platforms for systematically violating our policies" after a joint investigation with Citizen Lab and Confiant, and added Safe Browsing warnings. IAB Europe suspended the company from its global vendor list and said further confirmation "could also justify a definitive expulsion." Comcast-owned Beeswax removed it, and Vungle and Eskimi also acted. Discover-Tech and Candiru did not respond.

Citizen Lab is also tracking a separate actor it calls DARK CARTOGRAPHER, which uses Discover-Tech infrastructure to link ad IDs to phone numbers, with a dedicated report coming.

Marczak called the findings "surely just the tip of the iceberg" and warned that the problem is structural. "Until this architecture changes, or ad companies get serious about customer vetting, we're going to keep seeing this kind of abuse," he said. For people who might be targeted because of who they are or what they do, his advice is simple: turn off ad tracking, or block ads altogether.

Some offers on this page may be paid placements or contain affiliate links.