Online advertising has been weaponised to deliver spyware to selected devices without users clicking anything, according to research from the University of Toronto’s Citizen Lab.
The investigation , published with security firm Confiant, says Israeli ad-tech company Discover-Tech used its Controlium platform to help commercial spyware firms collect information users, identify people behind otherwise anonymous advertising IDs and target their devices with spyware.
The researchers have named the technique “AdFection” and describe it as the first publicly confirmed case of zero-click mercenary spyware delivered through targeted advertising.
Citizen Lab identified at least 45 devices at Al Jazeera that were targeted in 2024 and 2025, and found evidence of infections with spyware from Candiru, now known as Integrity Labs. Its researchers said network logs showed the devices encountered Discover-Tech ads before connecting to servers linked to Candiru.
The alleged method exploits the automated auctions used to buy and sell online ad space. These auctions information users and their devices so advertisers can decide whom to target. Citizen Lab says Discover-Tech used these identifiers to single out devices and serve ads containing code that could exploit software flaws, meaning simply displaying an ad was enough to compromise a device.
Ads were reportedly seen in apps including Duolingo, Yahoo Mail, Viber and Truecaller, and on websites including the BBC, The New York Times, Fox News and CBC. Citizen Lab stresses that an ad impression alone does not prove a device was infected, but says the scale of the operation exposes a systemic weakness in digital advertising.
The findings also raise questions over industry vetting. Discover-Tech appeared on “certified” and “approved” vendor lists maintained by Google and IAB Europe, and used major ad networks including Google, Yandex and Beeswax. Following the investigation, Google and IAB Europe removed Discover-Tech from their vendor registries in October 2026. Google terminated its access to its ad exchanges, Beeswax removed it from its ad-buying platform, Vungle (Liftoff) paused access pending review, and Eskimi blocked its accounts and domains
Citizen Lab is calling on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs broke the law. It argues the case shows that existing laws and industry self-regulation failed to detect or prevent the abuse, and urges advertisers, publishers and ad-tech firms to tighten controls across the supply chain.
The findings follow earlier cases of ads being used to spread malicious software. In 2022, Microsoft uncovered that Google Ads were used to steer users towards fake software downloads containing malware. In 2024, Intellexa’s Aladdin, a proof-of-concept system designed to deliver spyware to phones through online ads included plans for malicious ads posing as job offers for graphic designers and activists.
This story first appeared on Campaign Asia-Pacific .
How the NCAA turned its website from a digital information dump to a brand marketing touchpoint
Why Oatly is pouring its marketing efforts into coffee shop culture
R/GA’s chief business officer on growing revenue in ‘intelligence age’
World’s biggest brands spend less on ads: report
The CMO cheat sheet: Arby’s names Jenna Bromberg chief marketing officer
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
