Researchers Uncover Zero-Click Spyware Delivered Through Online Ads

Online advertisements were used to deliver spyware to devices belonging to journalists at Al Jazeera, according to an investigation by cybersecurity researchers that exposes a new abuse of the digital advertising ecosystem. The technique, dubbed “AdFection,” could compromise a device simply by displaying a malicious advertisement, without requiring the user to click a link or download a file.

The investigation by the University of Toronto’s Citizen Lab and advertising security firm Confiant linked the operation to Israeli advertising technology company Discover-Tech and spyware developed by Candiru, also known as Integrity Labs. Researchers confirmed that at least 45 Windows devices at Al Jazeera were compromised between 2024 and 2025.

Google has since removed Discover-Tech from its advertising platforms, saying the company systematically violated its policies.

How Malicious Advertisements Delivered Spyware

According to the investigation, Discover-Tech used its advertising infrastructure to track targeted users and help deliver spyware through online advertisements. The ads often promoted ordinary consumer products, making them difficult to distinguish from legitimate advertising.

The technique exploits the programmatic advertising system, which automatically matches advertisements with available spaces on websites and apps. Researchers found that malicious ads could be delivered to selected devices through this infrastructure, allowing spyware to reach targets when an advertisement loaded.

The method removes a common warning sign associated with cyberattacks: the need to click a suspicious link. In a zero-click attack, the victim may not knowingly interact with the malicious content at all.

Researchers described the findings as the first public technical confirmation of mercenary spyware being delivered through targeted online advertising. However, the spyware-linked ads represented only a fraction of Discover-Tech’s overall advertising activity, according to Confiant.

Advertising Network Reached Thousands of Digital Platforms

Citizen Lab said Discover-Tech’s advertisements appeared across more than 120,000 websites and 75,000 apps through its advertising partnerships. Confiant estimated that the company distributed at least 10 million advertisements daily and that its tracking arrangements could have exposed hundreds of millions of people to its broader surveillance infrastructure.

That potential reach does not mean hundreds of millions of devices were infected. Researchers confirmed spyware infections on at least 45 Windows devices at Al Jazeera, while the wider operation also involved tracking and attempts to collect information from users.

The investigation found that advertisements appeared in networks associated with sensitive organisations, including the United Nations, NATO and government institutions. The findings raise concerns about how advertising systems can expose users and organisations to surveillance without their knowledge.

Google and Advertising Partners Take Action

Google said it worked with Citizen Lab and Confiant during the investigation and removed Discover-Tech from its advertising platforms for systematic policy violations. Comcast-owned advertising platform Beeswax also removed the company, while IAB Europe suspended it from its list of approved vendors.

Al Jazeera condemned the spyware attacks targeting its staff and said it was taking steps to protect its employees and systems. Discover-Tech did not respond to requests for comment reported by Reuters.

The investigation also leaves important questions unanswered, including who commissioned the specific spyware attacks against Al Jazeera and how the advertising ecosystem can prevent similar operations.

Conclusion

The AdFection investigation demonstrates how digital advertising infrastructure can be abused as a spyware delivery channel. The findings raise questions about vendor screening, ad verification and the security of programmatic advertising, particularly for journalists and other high-risk users. Stronger platform oversight will be important to prevent legitimate advertising systems from being exploited for covert surveillance.