Citizen Lab caught spyware hacking devices through ads nobody clicked

An online ad can carry more than a picture. It can carry code, and researchers at the Citizen Lab, at the University of Toronto, have now shown that code being used to plant spyware on a chosen person’s device without a single tap. The lab calls the technique AdFection. Someone hacked this way “would not see anything amiss,” senior researcher Bill Marczak told Wired. “In fact, they might not even see any ad at all.”

That matters for anyone with a phone full of free apps. Zero-click attacks have mostly come through holes in messaging apps, which companies can patch. This one rode on the ordinary machinery that decides which ad you see: an auction that runs in a fraction of a second whenever an app or web page loads, and that already passes along your device’s advertising ID, your IP address and details about your phone.

At the center sits Discover-Tech, an Israel-registered firm that presented itself as an advertising company. According to the report, its platform, Controlium, let customers single out one target by advertising ID, browser cookie or IP address and push code to that device the moment an ad rendered. Everyone else got a normal ad. Citizen Lab links a series of attacks on the news network Al Jazeera, with high confidence, to Candiru, a spyware maker that now calls itself Integrity Labs. At least 45 devices inside the broadcaster were targeted, and one infected Windows computer gave up a file that pointed to Candiru’s servers.

How the researchers got inside is almost funny. Controlium’s login page shipped the full source code of its own dashboard, so the team saved the page, cut its links to outside servers and switched on every screen. A Discover-Tech server also left nearly four billion ad bidding records in the open. They show ads carrying the attacker’s script tag inside 75,373 Android and iOS apps and on 120,768 websites. Familiar names turn up: the messenger Viber showed more than 700,000 of those ads on Android, and they also appeared in Yahoo Mail, Opera Mini and Duolingo.

Those numbers need a careful read. A Discover-Tech ad on your screen does not mean your phone was hacked, the lab stresses. In most cases its server sent back no code at all, and the bidding data covers only one of the firm’s ad platforms over four months. Citizen Lab has not said which governments paid for the Al Jazeera operation, and its finding that the ads reached networks at NATO, the United Nations and several European institutions shows reach, not confirmed infections. In Norway the ads reached the networks of the parliament and the police; in Sweden, those of the armed forces and the national grid operator. The defenses open to ordinary people are blunt. Marczak’s advice for anyone who might be targeted “based on who you are or what you do” is to switch off ad tracking or block ads altogether.

The ad industry has started to move. Google says it blocked Discover-Tech from its ad platforms after a joint investigation with Citizen Lab and the security firm Confiant, and added Safe Browsing warnings for websites linked to the group. IAB Europe suspended the firm from its list of approved ad vendors, and Comcast-owned Beeswax removed it from its platform. Discover-Tech did not respond to Wired or TechCrunch.

Citizen Lab published the report on October 15, 2026. It covers the attacks on Al Jazeera in 2024 and 2025 and bidding data from March to June 2026. A second report is coming on a separate group the lab calls DARK CARTOGRAPHER, which it says used the same infrastructure to match phones’ advertising IDs to their phone numbers through weaknesses at mobile carriers in more than 30 countries.

Marczak calls Discover-Tech “surely just the tip of the iceberg.” His team did not have to look far for its ads. They showed up on the researchers’ own screens while they read the CBC and Yahoo websites and played a Sudoku game on Android.

Tags: online advertising, AdFection, Candiru, Citizen Lab, Discover-Tech, spyware