Researchers at Citizen Lab have documented what they describe as the first publicly confirmed zero‑click spyware attack delivered through targeted online advertising. The investigation identified Israeli adtech company Discover‑Tech as the intermediary that facilitated the delivery of malicious ads to devices, including those belonging to staff of Al Jazeera. The group’s Controlium platform is said to have leveraged the real‑time bidding system that selects advertisements for web pages and apps, using the data exchanged during bidding to pinpoint specific users. Once identified, the platform served those users with ads that contained spyware payloads.

The researchers traced attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru, an Israeli spyware developer now operating under the name Integrity Labs. The malicious ads appeared on more than 70,000 mobile apps and 120,000 websites between March and June 2026, reaching domains associated with government agencies, defense organizations and NATO. While no infections were confirmed within those institutions, the ads could have been used to map devices on the networks.

The operation reportedly funneled millions of devices toward servers tied to Candiru, though the connection does not necessarily indicate successful infection. Google terminated Discover‑Tech’s access to its ad exchanges and removed it from its approved vendor list; IAB Europe followed suit, and other participants such as Beeswax, Vungle and Eskimi also took action.

Discover‑Tech and Candiru did not respond to requests for comment. Citizen Lab concluded that the case reveals structural weaknesses in the online advertising ecosystem, which allowed a firm linked to commercial surveillance operators to operate within a vetted environment for years. The findings underscore how advertising infrastructure can be repurposed for espionage without the need for users to click on suspicious links or download files.