The University of Toronto’s Citizen Lab published “Exposing AdFection” on Oct 15, and calls it the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising in real attacks. It links, with high confidence, zero-click attacks that targeted at least 45 devices at Al Jazeera in 2024 and 2025 to spyware from Candiru, the Israeli vendor the US Commerce Department put on its Entity List in 2021. Al Jazeera’s own tech team first spotted the odd device behavior in 2024 and brought Citizen Lab in.
The mechanism. Discover-Tech, an Israel-based company that presents itself as an ad firm, bought placements through mainstream exchanges. Citizen Lab names Google, Yandex and Beeswax among the networks it worked with. The ad creative carried no exploit. When it rendered, embedded JavaScript sent the device’s IP address and mobile ad ID to a Discover-Tech server, which decided whether the device was a target. Everyone else got nothing back. Targets got code that ran in the browser or app, and Al Jazeera’s network logs show the hop from Discover-Tech infrastructure to Candiru validation servers to spyware command and control. Citizen Lab says Discover-Tech’s platform for this, Controlium, was also tied to Bindecy, an Israeli zero-click mobile exploit shop, and Intelos, another surveillance firm. Which exploits were used: Undisclosed.
Platforms. Ars Technica reports the attacks worked on iOS and Android. BleepingComputer reports Citizen Lab also recovered a DLL from a compromised Windows system and tied it to Candiru with high confidence. Al Jazeera says the implant collects files, browser cookies and saved credentials, keystrokes, screenshots, mic and webcam, and messages.
Scale. Per Citizen Lab, Discover-Tech placed 3.77 billion bids and won 442 million auctions between March and June 2026, and ads carrying its script tags ran in 75,373 mobile apps and 120,768 websites. It estimates hundreds of thousands to millions of users were sent to its profiling and infection domains. Those are reach numbers, not infection counts.
Why enterprise teams should care. Citizen Lab found Discover-Tech ad impressions on networks at NATO, the UN, the European Parliament and Commission, Sweden’s armed forces and grid operator Svenska kraftnät, Vattenfall, Saab and Volvo Group, Danske Bank, Vestas and Ørsted, and in the chip industry, with the most at Intel plus Nvidia, Micron, Texas Instruments, Broadcom and Arm. It also lists Apple, Microsoft, Raytheon and Westinghouse. In a co-timed report, ad-security firm Confiant said Discover-Tech ads also showed up in networks used by the Pentagon, the IAEA and the International Criminal Court, per Al Jazeera. An impression there means profiling at minimum, not confirmed infection, and Citizen Lab says those networks need follow-up investigation.
What we’d do today. Treat ad traffic on managed laptops and phones as untrusted code delivery. Push DNS or proxy ad-blocking to corporate endpoints and mobile fleets, and block Discover-Tech domains once the published indicators are in your intel feed. Retro-hunt DNS and proxy logs from 2024 onward for those domains, starting with execs, comms staff, and anyone in M&A, legal or government affairs. For high-risk users, turn on iOS Lockdown Mode and Android Advanced Protection, and limit the ad-funded apps allowed on work devices. Google, IAB Europe, Beeswax, Eskimi and Vungle have already removed Discover-Tech’s accounts or blocked its domains.