Ordinary Ads Secretly Installed Spyware With Zero Clicks
In short: On October 15, 2026, Citizen Lab published an investigation describing how Israeli ad-tech firm Discover-Tech bought entirely ordinary ad placements in mobile apps and websites and used them as a delivery channel for spyware from Candiru, a company blacklisted by the US government. Discover-Tech's platform, called Controlium, could infect a device "the moment an advertisement is rendered" — a true zero-click attack requiring no action from the victim. Between March and June 2026, these ads ran across more than 70,000 mobile apps and 120,000 websites, reaching millions of users worldwide, including at least 45 Al Jazeera journalists' devices. You can check and disable your device's ad identifier using our guide on stopping ad-identifier tracking.
What Citizen Lab found
The Citizen Lab investigation, partially published on October 15, 2026, describes a scheme where ordinary digital advertising stopped being just advertising. Discover-Tech purchased ad impressions through legitimate programmatic advertising exchanges — the same infrastructure that sells banner ads in any app or website — and used them as delivery infrastructure for spyware from Candiru. The dedicated platform, Controlium, was capable of automatically infecting a device "the moment an advertisement is rendered" — a textbook zero-click attack. The victim never needs to tap, click, or interact with anything; the infection fires from the ad simply loading.
Scale: not a targeted hit, but mass infrastructure
Unlike narrowly targeted spyware campaigns aimed at specific individuals, this is about mass advertising infrastructure. According to the investigation, infected ads ran across more than 70,000 mobile apps and 120,000 websites between March and June 2026, affecting millions of devices globally. Victims included at least 45 Al Jazeera journalists' devices, some belonging to reporters covering sensitive topics. The report also says malicious ads reached protected networks belonging to critical infrastructure and government bodies — NATO, several countries' defence ministries, and major international media networks are named. The report does not identify which specific client of Discover-Tech or Candiru ordered the targeting of Al Jazeera.
Why this is more dangerous than typical spyware
The most alarming part here isn't any single victim — it's the channel being used. Classic spyware like Pegasus still needs to be delivered via a phishing link or an app-specific vulnerability. Advertising is infrastructure already embedded in tens of thousands of legitimate apps and websites that ordinary people use every day: messengers, games, mail clients. If that infrastructure can be weaponized for surveillance, almost any internet user becomes reachable — regardless of whether they're of interest to an intelligence service or simply opened an app with an ad SDK. We covered a similar pattern — a trusted everyday channel turned into an attack vector — in our report on AI browser privacy risks.
What's known about the companies' response
Candiru was previously added to the US Commerce Department's blacklist in 2021 for selling spyware to authoritarian governments used to surveil journalists, human rights defenders and diplomats. Discover-Tech had not previously been publicly named in connection with similar accusations. At the time the investigation was published, neither company provided a substantive response to outlets that sought comment. The programmatic ad exchanges through which the infected ads were purchased are not named in Citizen Lab's report as knowing participants — the investigation describes them as a channel that was exploited, not as informed partners.
How to protect yourself from ad-based surveillance
You cannot fully eliminate the risk of infection through advertising infrastructure — this is a systemic vulnerability of the entire digital ad ecosystem, not a bug in one app. But several measures reduce your exposure:
- Disable personalized ads and your device's advertising identifier. This won't stop a zero-click exploit by itself, but it shrinks the data that can single you out as a target and the number of SDKs feeding you ads in the first place.
- Keep your OS and browser updated. Zero-click exploits typically rely on specific rendering vulnerabilities — timely patches close exactly the doors this technique relies on.
- Use ad and tracker blockers where permitted. If malicious code is distributed through ad impressions, blocking the ads themselves at the browser or network level removes a significant share of the risk.
- Encrypt your traffic with a VPN. A VPN won't stop a device-level zero-click exploit, but it hides your real IP and network activity from the trackers and ad networks that profile users for targeting — shrinking the surface that can single you out as a target in the first place. See how LiMP VPN handles this on the features page.
Sources
Frequently asked questions
What is a zero-click infection via advertising?
It's an attack where a device is infected with spyware the moment an ad is displayed, with zero user action required — no tap on the banner, no clicking a link. The infection fires simply because the ad was rendered.
Does this only affect journalists and government bodies?
No. The infected ads ran across more than 70,000 ordinary apps and 120,000 websites used by millions of regular people — messengers, games, mail clients. Journalists and government bodies are confirmed victims, but far from the only ones exposed.
Will a VPN protect against this kind of infection?
A VPN doesn't block the zero-click exploit itself — that fires at the device and ad-rendering level. But it hides your real IP and network activity from the ad networks and trackers that profile users for targeting, reducing the chance of being singled out as a target.