Israeli Ad Firm Linked to Zero-Click Spyware Attacks

Two studies published on October 15, 2026 by the University of Toronto's Citizen Lab and advertising security firm Confiant found that Israeli digital advertising firm Discover-Tech was using online ads to profile internet users and conduct targeted spyware attacks. Researchers linked the firm’s advertising infrastructure to attacks on at least 45 devices belonging to Al Jazeera.

The findings highlight the risks of how ordinary online advertising can be exploited as a vector for malware. The attacks reportedly did not require victims to click an advertisement, or open a suspicious link or download a file. For targeted victims it was possible for a specially configured advertisement to deliver spyware.

How Discover-Tech Used Online Ads to Deliver Spyware

Citizen Lab identified the advertising platform of Discover-Tech, Controlium, as being involved in the operation and had named the technique ‘AdFection’. Its investigation into approximately four billion advertising-bidding records found that Discover-Tech ads appeared on nearly 200,000 unique websites and Android and iOS apps across numerous countries during a four-month period. Confiant estimated the company served around 10 million advertising impressions daily.

Citizen Lab linked the infrastructure to Candiru spyware in attacks in 2024 and 2025. Reuters report that 45 Windows devices belonging to Al Jazeera were compromised. The researchers based their findings partly on network logs provided voluntarily by the broadcaster. They said the spyware could access messages, photos and emails, and could record calls or secretly activate microphones. However this does not prove that all features were being used against all identified devices.

Google and IAB Europe Take Action Against Discover-Tech

Advertising companies have taken action over the findings. Google removed Discover-Tech from its advertising platforms for systematically violating its policies, while IAB Europe suspended the company from its approved advertising vendor list. Discover-Tech and its chief executive, Dekel Boni, did not respond to requests for comment.

Wolfie Christl, a senior researcher at Citizen Lab, told Reuters the ‘way online advertising works today is a systemic security threat’.

What the Investigation Means for Online Advertising Security

Researchers called for regulatory investigations and stronger protections across digital advertising. The full number of compromised devices, the identities of all customers behind the surveillance campaigns and the total amount of information collected are unknown. Watch for further findings on the operation’s scope and any regulatory response.

#law enforcement #safety #online scams #cybersecurity #cyberattack #spyware