Zero-Click Spyware Infects Devices Through Targeted Online Ads

A surveillance infrastructure documented by The Citizen Lab and digital ad security firm Confiant shows mercenary spyware vendors delivering zero-click exploits through standard online advertising networks. The delivery mechanism, named AdFection, infects devices when an ad renders, requiring no clicks or downloads from the user.

The technical investigation focuses on Discover-Tech Ltd., an Israeli company founded in 2020 that operated an ad-targeting platform called Controlium. Researchers found Discover-Tech acted as a facilitator for commercial surveillance tools, allowing operators to fingerprint targets and deploy exploits within seconds of an ad loading.

Discover-Tech distributed ads across major commercial networks including Google, Microsoft, Comcast, and Yandex, reaching an estimated 10 million daily impressions across 120,000 websites and 75,000 applications. Confiant and Citizen Lab reported that Discover-Tech ads were served to devices on networks associated with the U.S. Department of Defense, NATO, the European Commission, the IAEA, Nvidia, Arm, and Italian government ministries. The investigation has not established whether devices on those specific networks were compromised or merely exposed to impressions.

According to The Citizen Lab, Discover-Tech infrastructure was used by Candiru, a surveillance firm on the U.S. sanctions list, to compromise up to 45 Windows computers belonging to Al Jazeera staff between 2024 and 2025. A separate actor tracked as DARK CARTOGRAPHER reportedly used Discover-Tech systems alongside mobile carrier vulnerabilities to link mobile ad IDs directly to personal phone numbers.

Following notifications from researchers, Google removed Discover-Tech from its ad platforms for systematic policy violations. Industry trade body IAB Europe suspended the company from its global vendor list pending investigation.

Surveillance Tactics in the Ad Ecosystem

Confiant co-founder and CTO Jerome Dangu noted that digital advertising security tools have historically targeted click fraud, consumer scams, and financially motivated malware rather than state-aligned surveillance. Confiant noted that ads delivering Candiru payloads made up a tiny fraction of Discover-Tech total volume, though Citizen Lab characterized Discover-Tech operations as purpose-built infrastructure for commercial surveillance.

Security Practices and Network Defenses

Wolfie Christl, a senior researcher at The Citizen Lab, characterized the automated ad delivery pipeline as a systemic vulnerability for private companies, state institutions, and civil society, stating that ad blocking should now be treated as a cybersecurity baseline. Technical investigations have not identified the full volume of global victims compromised by AdFection or the paying clients behind the Al Jazeera campaign.