Online advertising networks can silently infect devices with zero-click mercenary spyware
Digital ad auctions designed to target consumer promotions have been repurposed to deliver malicious surveillance software without requiring a single tap or click.
When an online advertisement appears inside a mobile application or on a webpage, a background digital auction has typically taken place in a fraction of a second.1 Advertising networks broadcast identifying information about a person and their device to determine which marketing company wins the right to display a banner.1 In standard online interactions, malicious software usually depends on human error, such as tricking someone into tapping a suspicious link or opening an untrusted file attachment.
Surveillance operators have found a way to bypass human interaction entirely by exploiting that automated commercial advertising pipeline. When an ad loads on a screen, the device can be compromised quietly in the background without any interaction from the owner. This delivery method turns the global infrastructure of internet advertising into a silent distribution mechanism for surveillance tools that can harvest private files, location data, and personal communications.
The transmission chain works because modern online advertising relies on real-time bidding, an automated auction system that shares device identifiers and network locations with dozens of corporate bidders in milliseconds.1 First, a targeted user opens an ordinary application or website that contains an ad slot. Second, the advertising platform transmits that device's unique profile into the auction network to find a matching sponsor. Third, a malicious participant wins the auction and delivers a customized advertisement to that specific screen. Finally, the server sends malicious code directly to the browser or application rendering the ad, infecting the device before the user has taken any action.
On October 15, 2026, researchers at The Citizen Lab, an interdisciplinary laboratory based at the University of Toronto, published technical evidence demonstrating this attack pathway operating in active surveillance campaigns.123 The research group, led by authors including Bill Marczak and Ron Deibert, documented how zero-click exploits were paired with online advertisements to infiltrate targeted devices invisibly.13 Working alongside security investigators at the ad quality platform Confiant, the researchers identified an attack framework they termed AdFection, which relies on the commercial advertising ecosystem rather than cellular networks or messaging platforms.3
How does an online advertisement deliver surveillance software?
A targeted advertisement delivers surveillance software by routing a device to intermediary servers that inspect its technical profile before sending an exploit.1 According to The Citizen Lab, an Israel-based company called Discover-Tech operated an advertising platform named Controlium that acted as a conduit between commercial ad vendors and mercenary surveillance developers.13 When a targeted device receives an advertisement placed through the platform, the device transmits its internet protocol address and mobile advertising identifier back to Discover-Tech servers.1 If the system confirms that the device belongs to a designated target, it responds with malicious JavaScript code that runs inside the local browser or application, executing an exploit that installs spyware without requiring the user to tap anything.13
The Citizen Lab reported that Discover-Tech concealed this activity by keeping the initial advertisements clean of malicious software.1 Because the public auction displays a seemingly harmless visual advert, the major commercial exchanges that host the auctions cannot detect the exploit during automated screening.1 Discover-Tech bid on billions of ad placements across global exchanges, including Google, Yandex, and Beeswax, appearing on apps ranging from language tools like DuoLingo to weather services and news sites.1
Who was targeted through commercial advertising exchanges?
Commercial advertising exchanges delivered exploit code to media professionals, international organizations, and government networks across several continents.13 The Citizen Lab confirmed that Candiru, an entity-listed surveillance firm, used Discover-Tech's infrastructure to hack at least 45 Windows computers at the media organization Al Jazeera across 2024 and 2025.31 Technical logs retrieved from Discover-Tech showed that another surveillance developer, Bindecy, also maintained user accounts on the Controlium dashboard to target devices.31
Between March and June 2026, Discover-Tech's ad bids resulted in impressions on devices operating inside high-profile institutions.3 The researchers observed ad impressions on computer networks belonging to the North Atlantic Treaty Organization, the United Nations, the European Parliament, the European Commission, and the Council of the European Union.1 Similar impressions appeared on devices connected to networks within the International Atomic Energy Agency and the International Criminal Court, as well as defense ministries and critical infrastructure operators across Sweden, Norway, Denmark, and Australia.3
What do these advertising records leave unanswered?
An advertising impression on a sensitive network confirms that a device viewed a banner, but it cannot prove whether that device was successfully infected with spyware.13 The bidding logs analyzed by The Citizen Lab record where advertisements were displayed, but determining whether an exploit payload was delivered requires forensic analysis of the specific machine.1 Furthermore, the researchers had access only to a subset of data from Discover-Tech's MyDSP platform over a bounded four-month window, leaving earlier campaigns and other ad network integrations unexamined.1 Discover-Tech, Al Jazeera, and Candiru's reported owner Integrity Labs did not provide comment to investigators.3
In response to the technical disclosures, Google and Beeswax terminated Discover-Tech's access to their advertising exchanges, while the industry group IAB Europe removed the company from its approved vendor registries.1 However, because real-time bidding inherently broadcasts device data to thousands of participating companies every day, researchers caution that blocking individual intermediaries cannot fully close the attack vector.1 Unless structural rules restrict the transmission of sensitive device data in programmatic auctions, the commercial internet will remain an attractive channel for silent surveillance.
The record
25 sentences trace to 3 sources.
-
1
C
citizenlab.ca Third-party reporting · citizenlab.ca · 15 Oct 2026 Exposing AdFection Executive Summary - The Citizen Lab See the source
-
2
MB
Matt Burgess, Lily Hay Newman Document · wired.com · 15 Oct 2026 ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads See the source
-
3
T
techcrunch.com Third-party reporting · techcrunch.com · 15 Oct 2026 Governments are hacking people with 'zero-click' spyware by showing them online ads | TechCrunch See the source