Back Middleeasteye

Israeli spyware targeted 'hundreds of millions' through zero-click ads, researchers find

Middleeasteye • October 15, 2026

The case marks the first-ever zero-click mercenary spyware, confirmed publicly, delivered through targeted ads, the group said in a report published on Thursday. The spyware also targeted devices linked to Al Jazeera Media Network.

Discover-Tech, an Israeli company that presents itself as a legitimate ad company but in reality operates for Israeli mercenary spyware partners like Candiru, placed targeted ads that directed millions of devices in dozens of countries to Candiru's servers for tracking and reconnaissance, according to the report.

The Citizen Lab found that in 2024 and 2025, at least 45 devices within Al Jazeera were targeted in a series of zero-click ad attacks purchased by Discover-Tech.

Discover-Tech controls a platform called Controlium that allows "mercenary partners to de-anonymize, fingerprint, and automatically infect devices" as soon as the ad is shown, without having the target even click on it.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Zero-Click Spyware Delivered via Targeted Ads: Citizen Lab Report On October 15, 2026, Citizen Lab revealed that the Israeli advertising firm Discover-Tech has been using targeted online ads to deliver zero-click spyware, dubbed 'AdFection', to devices without user interaction. This technique has reportedly infected at least 45 devices belonging to journalists at Al Jazeera between 2024 and 2025. The spyware, attributed to the Israeli company Candiru, operates by executing malicious code when an ad is displayed, allowing for covert surveillance. Discover-Tech's ads reached over 120,000 websites and 75,000 apps, potentially impacting hundreds of millions of users globally. Following the report, major platforms like Google and IAB Europe severed ties with Discover-Tech due to its systematic violations of advertising policies. The findings raise significant concerns about the security of the online advertising ecosystem and its exploitation for espionage purposes. 51 sources 78

Extracted Entities

Israeli spyware targeted 'hundreds of millions' through zero-click ads, researchers find

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (2)

Tools (1)