Cybersecurity researchers have uncovered the first known case of zero-click spyware delivered through ordinary online advertisements, a technique they call AdFection that turns everyday web pages into silent infection vectors. The technique was used to infect at least 45 devices belonging to journalists at the international news network Al Jazeera with mercenary spyware from Candiru, an Israeli firm now rebranded as Integrity Labs. The discovery of zero-click spyware in the advertising ecosystem represents what experts describe as a new and deeply concerning global security threat.
How Zero-Click Spyware Reached Al Jazeera’s Journalists
Al Jazeera’s in-house technology team first noticed unusual patterns on devices in 2024, and network logs provided to Citizen Lab at the University of Toronto in 2025 revealed how the operation unfolded. The attacks began in June 2025, targeting 45 devices used by Al Jazeera staff, including several journalists covering sensitive subjects. Malicious advertisements were purchased by Discover-Tech, an Israeli company posing as a legitimate advertising firm but acting as a facilitator for mercenary spyware partners.
The network identified Al Jazeera staff and redirected them to servers controlled by Candiru, which then installed spyware automatically. Unlike conventional phishing attacks, the zero-click spyware required no user interaction: victims were infected simply by visiting a webpage or refreshing an app, without clicking any links or downloading files. Candiru was blacklisted by the United States government in 2021 after Citizen Lab linked it to the hacking of at least 100 activists, journalists and political figures across 10 countries. Al Jazeera Media Network has condemned the targeting of its staff and called for accountability.
Discover-Tech and the Controlium Platform
At the centre of the operation sits Discover-Tech, which presents itself as a standard digital advertising company. According to Citizen Lab’s report, published on October 15, the firm operates a platform called Controlium that enables its mercenary partners to de-anonymise, fingerprint and automatically infect devices the moment an advertisement is rendered. Through this platform, spyware vendors can track targets and deploy exploits through ordinary ad slots. Each time the zero-click spyware was served through an ad impression, the victim had no chance to intervene, with infection taking hold within milliseconds.
The scale of the infrastructure is vast. Analysis of four billion Discover-Tech bidding records shows that during a four-month period, the company’s ads appeared on almost 200,000 unique websites and Android and iOS apps in dozens of countries, including Armenia, Bosnia, Denmark, Egypt, Kazakhstan, Montenegro, Pakistan, Serbia and Yemen. Discover-Tech’s ads also covertly directed millions of devices to contact Candiru’s servers, likely for large-scale tracking and reconnaissance. Ordinary users browsing news sites or using apps such as Duolingo could have received the tainted creatives.
Why Zero-Click Spyware Poses a Global Risk
Security experts say the findings confirm a threat that researchers have long feared. Because zero-click spyware needs no click, no download and no mistake by the victim, traditional advice about avoiding suspicious links offers no protection. The technique allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet. The zero-click spyware campaign shows how mercenary vendors now exploit the same targeting tools as marketers, microtargeting victims through identical machinery.
A separate threat actor, dubbed Dark Cartographer, is using Discover-Tech’s infrastructure to exploit vulnerabilities across numerous mobile carriers and link device advertising IDs to phone numbers, in what researchers call a mass de-anonymisation of internet users. Citizen Lab says it will detail its findings on that actor in a separate forthcoming report. A professor of information studies at the University of California, Los Angeles, told Al Jazeera that people are now being microtargeted, calling it the next level of surveillance.
What Happens Next for Ad-Based Surveillance
The revelations are expected to intensify pressure on regulators to police both the online advertising ecosystem and the mercenary spyware industry. Discover-Tech is linked to spyware and intelligence threat actors beyond Candiru, suggesting the AdFection pipeline may have served multiple clients. Because the zero-click spyware leaves victims with almost nothing to detect or defend against, experts argue that the burden must fall on platforms, ad exchanges and governments rather than on individual users.
For journalists, activists and officials, the message is stark: the phone in your pocket can be compromised by an advertisement you never noticed. As investigations continue, the full reach of the campaign and the identity of those who ordered the targeting remain open questions. Until ad exchanges are secured, zero-click spyware will remain an invisible threat to anyone carrying a phone.