Citizen Lab documents first zero-click mercenary spyware attack delivered via targeted ads

Spyware delivered by simply viewing an ad

The Citizen Lab has published what it describes as the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted online advertising, a technique the researchers have named "AdFection." According to the report, devices at the international news network Al Jazeera were infected with mercenary spyware sold by Candiru — a vendor the report says has rebranded as "Integrity Labs" — simply by rendering an advertisement. No tap or click on the ad was required.

Discover-Tech as the delivery pipeline

The malicious ads were purchased by Discover-Tech, an Israeli company that presents itself as an ordinary advertising business but which the Citizen Lab found operates as a facilitator for several mercenary spyware partners. The firm runs a platform called Controlium that, according to the report, lets those partners de-anonymize targets, fingerprint their devices and automatically infect them at the moment an ad is displayed.

Beyond Candiru, the Citizen Lab links Discover-Tech to other mercenary spyware and intelligence actors, including Intelos and Bindecy. The researchers also identify a separate threat actor, dubbed DARK CARTOGRAPHER, that uses Discover-Tech infrastructure to exploit vulnerabilities in numerous mobile carriers and link device advertising IDs to phone numbers, mass-deanonymizing internet users; those findings will be detailed in a forthcoming report.

How the attack chain works

The report walks through the mechanics. Real-time bidding auctions, which the Citizen Lab says run hundreds of billions of times a day on exchanges operated by companies including Google, expose granular data about each user — device identifiers, precise location and IP address — so advertisers can decide whether to bid on a single impression. Crucially, ads are not just images or video: they can contain code from the advertiser or demand-side platform that executes inside the app or browser while the ad is shown. In the AdFection chain, that code pulls in additional JavaScript, which can include a browser exploit that installs spyware. Because the payload can be keyed to a specific user or device identifier, arbitrary code can be delivered to exactly one person's device, and the mere display of the ad is enough for infection.

Scale of the operation

The Citizen Lab analyzed four billion Discover-Tech bidding records and found that over a four-month period the company's ads were shown on almost 200,000 unique websites and Android and iOS apps across dozens of countries. The ads also covertly directed millions of devices to contact Candiru's servers, which the researchers assess was likely done for large-scale tracking and reconnaissance.

Certified access to major ad networks

Discover-Tech was not a fringe operator. According to the report, it appeared on lists of "certified" and "approved" vendors maintained by Google and the industry association IAB Europe, and it served ads through major networks including Google, Yandex and Beeswax. It also used the GDPR consent framework to reach users inside the European Union. The Citizen Lab argues the abuse illustrates structural flaws in the online advertising system, which failed to detect or prevent it, and calls on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs violated applicable laws.

After the Citizen Lab disclosed its findings, Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi took action to cut Discover-Tech off from the digital advertising ecosystem. Other ad vendors involved in its operations did not respond within the comment timeline provided.

Why it matters

Ad-delivered malware has been discussed as a theoretical vector for years, but the Citizen Lab's report is the first public technical demonstration of it being used to deliver mercenary spyware to real victims. It changes the threat model for journalists, activists and other high-risk users: an ad served through the same plumbing that carries ordinary commercial advertising can be enough to compromise a phone, with no phishing message and no user interaction to notice. The findings also show how the programmatic ad ecosystem's individual-level targeting and third-party code execution can be repurposed wholesale for surveillance and deanonymization, and how certification schemes and major exchanges failed to catch a vendor allegedly acting as a spyware pipeline. For defenders, the report suggests that ad blocking, aggressive filtering of third-party ad code and monitoring for unexpected ad-related network callbacks now belong in the counter-espionage toolkit.