Zero-Click Spyware Hid in Everyday Ads — Researchers Link Israeli Ad Firm to Candiru Hacking Campaign

The banner ad for the cheap earbuds looked ordinary. It did not ask you to click, and you never had to. According to two research groups, that was enough: the ad itself was part of a vast spy operation that turned the everyday machinery of online advertising into a delivery system for mercenary spyware.

In coordinated reports published Thursday, Canada's Citizen Lab and New York-based ad-security firm Confiant linked Israeli ad agency Discover-Tech to an operation that tracked internet users through ad networks and routed selected targets to spyware infrastructure run by Candiru, the Israeli spyware company blacklisted by the US in 2021.

The firm's ads reached more than 120,000 websites and 75,000 apps, Citizen Lab says. Merely loading a page was enough for devices to be identified and, in selected cases, silently infected.

Citizen Lab calls the method "AdFection" and describes it as the first publicly confirmed case of zero-click mercenary spyware delivered through online advertising.

Discover-Tech ran a platform called Controlium that drew on real-time bidding data to build dossiers on devices.

Mobile advertising identifiers, IP addresses and browser fingerprints were used to de-anonymize and single out individuals, and when an ad impression matched a target, the device was quietly handed off to Candiru's validation servers, where an exploit could run without any user interaction.

The scale was industrial. Confiant says Discover-Tech was issuing at least 10 million ads a day worldwide, and that data-sharing arrangements known as cookie matching let the company keep tracking people even beyond the pages carrying its ads.

"Very likely hundreds of millions of people would have been touched by Discover-Tech," Confiant co-founder Jerome Dangu told Reuters.

The researchers also say the firm sometimes extracted phone numbers from smartphone users, and Confiant rebuilt Controlium's control dashboard from exposed source code, authentication logs and nearly four billion ad-bidding records.

Citizen Lab says a powerful form of Candiru spyware delivered through Discover-Tech's ads compromised 45 Windows devices belonging to Qatar's Al Jazeera between 2024 and 2025. The finding was confirmed because the media group shared its network logs with the researchers.

The ads also surfaced on networks tied to NATO, the International Atomic Energy Agency, the International Criminal Court, the US Pentagon and the European Parliament. An ad appearing on a sensitive network does not by itself prove an infection, the researchers caution, but the reach shows how deeply the operation sat inside trusted environments.

Candiru, which has since rebranded as Integrity Labs, was placed on the US Commerce Department's entity list in 2021 for supplying spyware that foreign governments used against officials, journalists, businesspeople and activists. The reports also link the operation to surveillance vendor Intelos.

The fallout was immediate. Google removed Discover-Tech from its advertising platforms and vendor lists, while IAB Europe and several other ad platforms suspended or blocked the firm.

Discover-Tech did not respond to requests for comment, and its founder Dekel Boni did not reply to messages sent through LinkedIn. Citizen Lab senior researcher Wolfie Cristl warned that the problem extends beyond one company: "The way online advertising works today is a systemic security threat," he told Reuters.

Who commissioned or operated the attacks remains unresolved, and the researchers say a follow-up report on a related actor, DARK CARTOGRAPHER, is forthcoming. For now the warning is uncomfortable: the most invisible part of the web, the ads everyone scrolls past, was quietly carrying some of its most sophisticated malware.