Spyware vendors found a way to make targeted ads even worse

The online advertising industry has found a new way to make itself even more unpopular, with one adtech outfit accused of helping spyware vendors infect people's phones without them even clicking an ad.

Researchers at Citizen Lab say they've uncovered the first publicly confirmed case of a zero-click mercenary spyware attack being delivered through targeted online ads, with devices at Al Jazeera among those infected.

The technique, dubbed "AdFection," turns advertising networks into a spyware delivery system.

Simply opening a website or app can be enough to trigger the attack, with no suspicious links or downloads involved.

Israeli adtech firm Discover-Tech is allegedly behind the operation, according to researchers at Citizen Lab, which says the company acts as a middleman between the online advertising industry and multiple spyware and hacking vendors.

"We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse," the researchers wrote.

“In fact, it appears that serving as this bridge is Discover-Tech’s primary purpose." Discover-Tech’s Controlium platform exploits the real-time bidding system that decides which ads appear on websites and apps.

Every time someone loads a page, advertisers compete for available ad space and, in the process, receive information about the user's device and location.

Discover-Tech allegedly used that data to identify specific targets and serve them malicious ads.

One spyware vendor linked to the operation is Candiru, the Israeli developer now known as Integrity Labs.

Citizen Lab traced attacks against at least 45 devices at Al Jazeera in 2024 and 2025 to Candiru spyware delivered through ads from Discover-Tech.

Discover-Tech didn't have to sneak into the advertising system, as Google and IAB Europe had listed the company as an approved vendor since 2020, apparently unaware of what it was Citizen Lab claims it was doing with that access.

Citizen Lab sifted through nearly four billion ad-bidding records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026.

Some reached networks belonging to government agencies, defense organizations, and NATO.