Ordinary web ads can become a route for zero-click spyware
· BehindLines newsroom
Israeli advertising agency Discover-Tech is alleged to have acted as a conduit for spyware capable of infecting a device without any action by its user. That is the conclusion of a report published on 15 October by the Citizen Lab, a research laboratory at the University of Toronto, and covered by the Guardian and Al Jazeera. The researchers named the technique AdFection.
According to the report, Discover-Tech's Controlium platform lets its clients profile internet users on a mass scale, identify them behind their anonymity and then target selected individuals. The Citizen Lab links attacks against the Qatari broadcaster Al Jazeera in 2024 and 2025 to spyware from Candiru, since renamed Integrity Labs, with a high degree of confidence. At least 45 of the broadcaster's devices were targeted.
Just displaying an ad can be enough
The mechanism relies on programmatic advertising. Each time a page is displayed, a very brief automated auction puts dozens of companies in competition using the internet user's profile. According to the report, an apparently innocuous ad for a game or telecommunications operator can collect the person's identity and IP address. If that person has been selected as a target, a spyware supplier can then send malicious code in seconds, without a single click.
Three groups need to be distinguished. The researchers estimate that millions of devices were probably profiled without their users' knowledge: seeing these ads does not mean a device was infected. Far fewer devices were targeted, and the report gives no total for those actually infected. Confiant, another research company, found traces of these ads on government networks, including the US Department of Defense, as well as those of the International Atomic Energy Agency and the International Criminal Court.
What this changes
Several advertising networks responded after being alerted. Google cut Discover-Tech off from its ad exchange platforms, while other intermediaries removed it or suspended its access. Discover-Tech and Candiru did not respond to the Citizen Lab within the deadline it set. The actual scale of infections remains unknown.
The researchers call on regulators and cybersecurity agencies to investigate the advertising market's intermediaries, which face very little oversight. For targeted journalists, activists and diplomats, being careful with suspicious links is no longer enough: the threat comes through advertising spaces that nobody chooses to open.