A new investigation links targeted online advertising to sophisticated spyware attacks, raising fresh questions about digital privacy and the security of journalists, government officials and ordinary internet users.
GAWAH Technology Desk
Online advertisements are designed to attract attention, promote products and track consumer interests. But a cybersecurity investigation has uncovered a more troubling possibility: advertising infrastructure can be exploited to help deliver sophisticated spyware to selected devices without requiring users to click a link.
In a report published on October 15, 2026, researchers at the University of Toronto’s Citizen Lab documented a campaign they call AdFection. The investigation describes how an Israel-based company, Discover-Tech, allegedly helped connect targeted advertising infrastructure with commercial spyware operations.
The researchers reported evidence that devices at international broadcaster Al Jazeera had been infected using spyware associated with Candiru, a surveillance software vendor also known as Integrity Labs. Citizen Lab described the findings as the first public technical confirmation of mercenary spyware being delivered through targeted online advertisements.
How can an advertisement infect a device?
Most online advertisements are delivered through automated systems that determine which advert a user sees based on available information about the user, device or browsing context. These systems can involve real-time bidding, in which advertising companies exchange information and compete to display ads in fractions of a second.
Citizen Lab’s investigation describes how this infrastructure was allegedly repurposed to identify selected devices and deliver malicious code through advertisements. The technique, known as a zero-click attack, can compromise a vulnerable device without requiring the target to open an attachment, tap a link or respond to a suspicious message.
That makes the threat concerning: many familiar security warnings focus on avoiding unfamiliar links and attachments, while a zero-click attack can bypass that point of human interaction.
However, the findings do not mean that every online advertisement is dangerous or that ordinary advertising automatically gives advertisers the ability to hack a device. The reported attacks involved specialised spyware and a targeted operation.
What did the investigation uncover?
Citizen Lab reported that at least 45 devices at Al Jazeera were targeted and infected through the campaign during 2024 and 2025. Researchers linked the attacks to spyware associated with Candiru.
The investigation identified Discover-Tech as a company allegedly operating between the commercial advertising ecosystem and spyware vendors. Its advertising infrastructure was reportedly used to profile potential targets and determine which devices should receive malicious content.
Researchers also examined advertising records showing that the company’s ads appeared across large numbers of websites and mobile applications. Some advertisements were served to devices connected to government, military and other sensitive networks.
Exposure to an advertisement does not by itself establish that a device was infected. The investigation documented confirmed compromises in a specific set of cases, alongside wider evidence of advertising activity that could have exposed other potential targets. The report did not conclusively identify the governments behind the operations.
Following the investigation, several advertising platforms took action against Discover-Tech. Citizen Lab reported that Google terminated the company’s access to its ad exchange platforms, while other providers blocked or suspended its access.
The findings are detailed in Citizen Lab’s report, Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware.
Why journalists and news organisations should pay attention
The findings have particular significance for journalists, editors, human rights researchers and organisations that handle confidential information. Newsrooms regularly work with sensitive sources, unpublished investigations, confidential communications and information about people who may face retaliation for speaking to the media.
A compromised device could expose communications and other sensitive information, depending on the spyware’s capabilities and the vulnerabilities it exploits. An attack against a journalist can therefore create risks not only for the individual but also for sources, colleagues and ongoing investigations.
The investigation does not establish that all news organisations or journalists are being targeted. It does demonstrate why digital security cannot depend exclusively on recognising suspicious messages.
What can users do to reduce the risk?
There is no single measure that can guarantee protection against sophisticated zero-click spyware. Such attacks may exploit previously unknown vulnerabilities or target particular devices and operating systems. Users can nevertheless strengthen their basic security:
- Install software updates promptly. Security updates can close vulnerabilities that attackers exploit.
- Use reputable ad-blocking and tracking-protection tools. These can reduce exposure to some malicious advertising, although they cannot eliminate every attack.
- Limit advertising tracking. Review privacy settings and restrict advertising identifiers where the operating system permits it.
- Be cautious with unexpected device behaviour. Unusual activity can have many causes and is not, by itself, proof of spyware infection.
- Seek specialist help if you face a credible targeting risk. Journalists and other high-risk individuals should consider expert digital-security assistance rather than relying on routine consumer security tools alone.
For organisations, the findings reinforce the need for device management, timely patching, incident-response procedures and specialised support for staff who handle sensitive material.
The wider problem: when advertising becomes surveillance infrastructure
The AdFection investigation highlights a structural challenge for the online advertising industry. Advertising systems are designed to distribute content at enormous scale while processing information about devices and audiences. The same reach and targeting capabilities can become dangerous when exploited by surveillance operators.
The issue extends beyond one company or one spyware campaign. It raises questions about how advertising vendors are vetted, how malicious code can pass through complex supply chains and whether existing controls are sufficient to prevent commercial infrastructure from being repurposed for covert surveillance.
The evidence presented by Citizen Lab does not establish that the entire advertising industry is involved in spyware operations. Instead, it illustrates how legitimate digital infrastructure can potentially be abused by actors seeking to identify and compromise specific targets.
For internet users, the lesson is not to assume that every advert is malicious. It is to recognise that online security threats are evolving beyond traditional phishing messages and suspicious downloads. In a targeted spyware operation, researchers warn, an advertisement could become part of an attack that the intended victim never knowingly engages with.
Sources
- University of Toronto’s Citizen Lab — research and technical findings on the AdFection campaign.
- Ars Technica — technical reporting on zero-click spyware and targeted advertising.
- TechCrunch — additional reporting on the investigation and advertising platforms’ responses.
