Latest
Category 2 Hurricane Isaias nears landfall, leading to production shut-insUkraine resumes attacks on Russian oil refineries, officials say, after brief truceBig Walk skipped Xbox to boycott Microsoft’s involvement with IsraelTrump’s ambassadors: the loyalists and allies at the center of controversyUS officials considering ad campaign to urge South African Afrikaners to emigrateGreetings from Mexico City, where a bullfighting ban doesn't stop this matador trainingTrump Says the Border Is Secure. Texas Gov. Greg Abbott Keeps Declaring an Emergency.Category 2 Hurricane Isaias nears landfall, leading to production shut-insUkraine resumes attacks on Russian oil refineries, officials say, after brief truceBig Walk skipped Xbox to boycott Microsoft’s involvement with IsraelTrump’s ambassadors: the loyalists and allies at the center of controversyUS officials considering ad campaign to urge South African Afrikaners to emigrateGreetings from Mexico City, where a bullfighting ban doesn't stop this matador trainingTrump Says the Border Is Secure. Texas Gov. Greg Abbott Keeps Declaring an Emergency.
← Signal: Tech & AI

Researchers Document Zero-Click Spyware Campaign Delivered Through Targeted Ads

Confirmed1 source · Oct 15, 2026

Citizen Lab has published the first detailed technical evidence of sophisticated spyware automatically infecting devices via digital advertisements, with 45 Al Jazeera devices targeted through ads allegedly issued by an Israeli firm and linked to mercenary spyware developer Candiru.

Researchers Document Zero-Click Spyware Campaign Delivered Through Targeted Ads
Image via Wired

What happened

On Thursday, researchers from Citizen Lab at the University of Toronto revealed a campaign dubbed "AdFection" in which an Israeli-registered advertising firm allegedly connected to servers linked to spyware company Candiru silently infected dozens of devices with malware through ads. During 2024 and 2025, 45 devices belonging to news outlet Al Jazeera were targeted with zero-click attacks delivered by ads from Israeli-founded marketing firm Discover-Tech, which distributed spyware attributed to Candiru. Citizen Lab's analysis found that infected devices contacted domains linked to Discover-Tech and then connected to infrastructure associated with Candiru. By analyzing ad-bidding records publicly exposed on the Discover-Tech website, researchers found that ads linked to Discover-Tech with attacker script tags were shown in more than 70,000 mobile apps and over 120,000 websites between March and June 2024. Google, after collaborating with Citizen Lab, terminated Discover-Tech's ad platform registration, and the Interactive Advertising Bureau suspended the company from its global vendor list.

Context

Zero-click attacks represent a critical threat because they install malware automatically without requiring any user interaction or mistakes, and this case documents their merging with the advertising ecosystem's infrastructure for the first time in published technical detail. The sprawling real-time bidding process that powers digital advertising enables firms to collect vast device data and target specific individuals at scale, creating what researchers describe as an architecture "perfectly suited to the mercenary spyware industry." Citizen Lab estimates that millions of devices were directed to Candiru's servers for profiling. The vulnerability is particularly acute because users have limited defensive options beyond blocking ads entirely, according to researchers—a challenge that intelligence agencies like the NSA and CIA reportedly recognize. The incident underscores how the combination of targeted ad capabilities and sophisticated spyware represents an evolving threat to journalists, activists, and other high-value targets.

What's disputed

Discover-Tech and its CEO did not respond to requests for comment from WIRED. Integrity Partners, believed to own Candiru's assets following U.S. sanctions in 2021, did not respond to requests for comment. Al Jazeera, which participated in the investigation and shared device logs, did not respond to a request for comment.