Zero-Click Spyware Attacks Target Phones via Israeli Ad Network, Al Jazeera Hit

Ender Öztürk

October 16, 2026

A sophisticated new zero-click spyware attack has been uncovered, exploiting internet advertising infrastructure to target millions of users without requiring any interaction. Researchers from Citizen Lab and advertising security firm Confiant revealed that Israel-based Discover-Tech utilized its digital ad network to profile vast numbers of devices and facilitate the infection of selected targets with Candiru spyware. This groundbreaking method, dubbed ‘AdFection,’ allowed the malicious software to infiltrate devices merely by loading an ad, bypassing the need for users to click on anything. The findings highlight a critical vulnerability in the digital advertising ecosystem, demonstrating its potential for weaponized surveillance.

Zero-Click Spyware Attacks Exploited Ad Platforms

A joint investigation by Citizen Lab and Confiant has revealed how online advertising systems can be weaponized to distribute spyware. Dubbed “AdFection,” this method allowed Israel-based Discover-Tech to reach devices by displaying ads on various websites and applications. The most alarming aspect is that a user did not even need to click; merely loading the advertisement on a targeted device could initiate the attack chain, according to researchers.

No User Interaction Was Required for Infection

Upon an ad loading, a connection was established with Discover-Tech’s servers, transmitting device information. If a user was not a target, no attack code was sent. However, for selected targets, the server returned device-specific code, enabling the attack to proceed without user interaction. This eliminated the need for clicks, downloads, or suspicious installations; simply displaying a crafted ad sufficed. Citizen Lab confirmed this as the first publicly verified technical demonstration of zero-click spyware attacks via targeted advertising.

Discover-Tech’s Network Reached Millions Globally

Discover-Tech’s operations were extensive. Citizen Lab analyzed four billion ad bid records from March to June 2026, finding Discover-Tech ads on over 120,000 websites and 70,000 mobile applications. Confiant estimated about 10 million ad impressions daily. While most impressions profiled users, attack code was sent only to specific targets. Researchers indicated ads collected information like IP addresses, ad IDs, cookies, and device characteristics, enabling precise targeting. Discover-Tech’s infrastructure was also used by another threat actor attempting to match mobile ad IDs with phone numbers.

Al Jazeera Employees Were Among the Identified Targets

The attacks’ real-world impact was confirmed, as Citizen Lab revealed at least 45 devices within Al Jazeera were targeted by zero-click attacks via Discover-Tech ads in 2024 and 2025. Network records showed compromised devices first communicating with Discover-Tech, then with verification servers linked to Candiru. Analysis of a Windows DLL file from a compromised device further established this connection. Citizen Lab confidently links these attacks to Candiru spyware, an Israel-based commercial spyware firm blacklisted by the U.S. Department of Commerce in 2021 for targeting officials, journalists, and activists.

Sensitive Networks Also Encountered Discover-Tech Ads

Research also highlighted alarming findings regarding networks exposed to Discover-Tech ads. Citizen Lab’s records included systems connected to NATO and United Nations networks, along with the European Parliament, European Commission, and various national government institutions. Confiant detected Discover-Tech ad impressions on networks associated with the U.S. Department of Defense, the International Atomic Energy Agency, and the International Criminal Court. Ads were also observed on networks of semiconductor companies like Intel and Nvidia. Researchers cautioned that an ad’s presence on a network does not alone prove targeting or infiltration, but it confirms exposure to Discover-Tech’s profiling infrastructure.

Industry Giants Have Blocked Discover-Tech’s Access

Following the research, numerous companies acted against Discover-Tech. Google removed Discover-Tech from its ad provider lists and terminated its access to ad exchanges. IAB Europe also delisted the company. Beeswax (Comcast) ended Discover-Tech’s platform access, while Eskimi blocked accounts and domains. Liftoff (Vungle) suspended its access pending review.

Digital Advertising’s Vulnerabilities Have Been Exposed

This incident technically demonstrates, for the first time, that the digital advertising ecosystem can deliver spyware directly to specific targets, not just for profiling. Given that billions of ad auctions occur in seconds, the problem extends beyond a single company. Infrastructure designed for detailed user profiling for ads can become an extremely sensitive targeting tool when such data falls into malicious hands.

What are your thoughts on this unprecedented use of advertising technology for surveillance? Share your concerns and opinions on how to better protect digital privacy in the comments below.