|
Getting your Trinity Audio player ready...
|
Researchers have documented the first public case of zero-click spyware delivered through targeted online advertising, and the finding is forcing a hard look at how much trust the global ad industry places in its own vetting. The report, released on Thursday by the Citizen Lab at the University of Toronto, describes an attack that needed no tapped link and no opened file. Seeing an ad was enough.
The Citizen Lab calls the technique AdFection. Its 72-page report, published on its website, says devices at the international news network Al Jazeera were infected with spyware from Candiru, an Israeli surveillance vendor reportedly now owned by US-based Integrity Labs. The researchers say they reached that conclusion with high confidence and that at least 45 Al Jazeera devices were targeted in 2024 and 2025.
Wolfie Christl, one of the report’s co-authors, told The Globe and Mail the finding was “kind of a nightmare,” because it shows a device could be infected simply by viewing an ad on a website or in a mobile app. The report lists Christl alongside Bill Marczak, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert.
At the centre of the investigation is a company called Discover-Tech, which the researchers describe as an Israel-based enabler of mercenary spyware. On the surface it looks like an ordinary advertising business. According to the Citizen Lab, it functions as a bridge between spyware vendors and the legitimate ad ecosystem, and the researchers found no evidence of genuine advertising activity from the company.
Discover-Tech runs a platform called Controlium, which the report characterises as a one-stop service for spyware firms that want to hack targets through ads. The Citizen Lab says Candiru was among its users. The platform is also linked to Bindecy, a company that specialises in zero-click mobile exploits, and to another surveillance vendor called Intelos.
The mechanics matter because they explain why this is so hard to spot. Most of the web’s targeted advertising is sold through real-time bidding, in which an auction runs in a fraction of a second every time a page or app loads. The Citizen Lab notes that these auctions handle hundreds of billions of bids and sales each day, broadcasting a large volume of data about people and their devices along the way.
According to the report, when a person sees one of Discover-Tech’s seemingly harmless ads, their advertising identifier and IP address are sent to the company’s servers. If that person is picked as a target, the device then receives malicious JavaScript that runs in the browser or app and exploits it to install spyware. The ad itself does not carry the exploit code, which the researchers say helped hide the real purpose of the campaign from the platforms delivering it.
The scale is what separates this from a narrow, one-off intrusion. The researchers analysed billions of bidding records and found that Discover-Tech’s ads sent millions of devices across dozens of countries to its profiling and infection servers. Reporting on the findings put the reach at nearly 200,000 websites and apps. The Citizen Lab says it saw the ads in apps ranging from language-learning and dating tools to period trackers, calling apps and a webmail service, and on news and weather sites including the BBC, the New York Times and AccuWeather.
A caution is necessary here. Seeing an ad on a given site or app does not mean that publisher did anything wrong, and the report states plainly that an impression alone does not confirm targeting or infection. Ads reach publishers through intermediaries, which is exactly the weakness the researchers are pointing at.
The report also draws attention to where some of those ads appeared. The Citizen Lab says bidding data showed impressions on networks tied to government bodies, defence organisations, critical infrastructure operators, universities and media outlets. It names NATO and United Nations networks and European Union institutions among them, along with a long list of national agencies in Europe, Australia and elsewhere. In the researchers’ assessment, impressions on those networks would at minimum have led to profiling, and in some cases could have led to Candiru or other code running on a device. They stress that their visibility is limited to one slice of Discover-Tech’s data and that follow-up investigation is needed.
Several questions remain open. Public summaries of the work do not spell out which browser, operating system or app weaknesses were exploited, and independent analysts have pointed out that confirmed mobile infections have not been established for this campaign. The Citizen Lab’s confirmed finding concerns devices at Al Jazeera. Whether any phone was compromised is a separate matter that the available material does not settle.
The case also fits a pattern at Al Jazeera. The Citizen Lab previously reported that 36 personal phones belonging to journalists, producers, anchors and executives at the network were hacked with Pegasus spyware from NSO Group. Zero-click methods have a history too. A flaw known as ForcedEntry, used to deliver Pegasus without any user action, prompted an emergency Apple patch in 2021, and security analysts warned at the time that such threats would persist.
Industry fallout began quickly. The researchers say Discover-Tech had appeared on lists of certified or approved ad vendors maintained by Google and the industry body IAB Europe, and they describe that as evidence of dangerously weak oversight. Following the investigation, Google and IAB Europe removed the company from their vendor lists, and Google and the ad platform Beeswax cut off its access to their systems. The Citizen Lab’s release was timed to coincide with a separate investigation by the ad-security firm Confiant, which reached its own conclusions about weaponised ad tech. At the time of writing, no public response from Discover-Tech or Candiru had turned up in the coverage reviewed.
For ordinary users, the practical risk is low. Spyware of this kind is expensive and is typically aimed at journalists, officials, activists and others of interest to state clients, not at the general public. But the technique shows that exposure does not depend on any careless click, and the same ad infrastructure touches nearly everyone with a smartphone or browser. General security habits still carry weight. Installing operating system and browser updates promptly closes the holes exploits depend on. A reputable ad blocker reduces how many ads load at all, which the researchers’ summary coverage notes can stop ads appearing in browsers and apps. People at higher risk can look at the stricter protection modes offered by Apple and Google, which limit some of the web features attackers rely on. These are general precautions rather than guidance from the report.
The bigger story is regulatory. The researchers argue that existing laws and industry self-regulation failed to catch or prevent AdFection, and their report offers recommendations to regulators, defenders and advertisers. The Citizen Lab says its investigation is continuing, so the list of affected networks and organisations may grow. Readers following the wider cybersecurity beat can find more coverage at BusinessTech.
