How zero-click spyware ads work and how to defend

Online ads can now be a delivery route for government-grade spyware, and Citizen Lab has the logs to show it. In a report published Thursday, Oct. 15, 2026, the University of Toronto research group said an Israeli ad firm, Discover-Tech, served ads that silently infected devices at Al Jazeera. Citizen Lab says the 2024 and 2025 campaign hit 45 or more devices, and it links the attacks to Candiru spyware with high confidence. That is Citizen Lab’s attribution, not a court or government finding.

Google and other ad platforms have since cut Discover-Tech off. For IT teams and anyone who might be a target, the useful part is the mechanics, because they point to specific things to block and search for.

How the attack works, step by step

Each ad carries a tiny piece of code that reports back to Discover-Tech. The company’s server then decides whether the viewer is worth attacking, and only then does anything malicious arrive. Citizen Lab named the technique AdFection and calls it the first public technical confirmation of zero-click mercenary spyware delivered through targeted ads.

1. An ad is sold through the usual automated auction and appears on a website or in an app.
2. The ad’s code sends the device’s advertising ID and IP address to a Discover-Tech server.
3. That server decides whether the device is a target. If it isn’t, nothing more is sent. If it is, attack code goes to the browser or app.
4. The attack code runs as soon as the ad loads. In some cases the ad loads out of sight, and infection takes seconds.

Discover-Tech presents itself as an ordinary digital advertising agency. Citizen Lab says its platform, Controlium, lets clients identify, fingerprint and automatically infect devices when an ad is shown. Marczak, a senior Citizen Lab researcher, put the victim’s experience plainly to Wired:

“Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all.”

What does the three-hop pattern look like in your logs?

Al Jazeera’s network logs repeated one chain on every infected device: a call to a Discover-Tech ad server, a hop to a Candiru server that screens targets, and a final connection to the command-and-control server running the spyware. Al Jazeera cooperated with the investigation, supplying traffic logs and a single Windows DLL from a compromised device.

That file is the basis for the attribution. Its techniques match a Candiru tool Citizen Lab analyzed in 2021. Researchers got the spyware sample but never captured the initial exploit that compromised the browser or app, so they infer that first step from how the attack was set up, according to The Hacker News.

If you run a network, the sequence is what to hunt for. One hit on an ad domain means little by itself, since Wired notes that not every Discover-Tech ad was necessarily weaponized. Those three hops in order, from the same device, are a different matter and deserve an incident ticket.

Start with the published indicators

Citizen Lab and Confiant, a US ad-security firm that investigated alongside it, published indicators of compromise: domains, file hashes and command-and-control servers. One Discover-Tech ad-server domain is mtrtb[.]com. Pull the full lists from the research itself, which The Hacker News summarizes, rather than from any news recap.

Two practical notes. First, push the domains into DNS, proxy and firewall blocks, then search your historical logs, not just new traffic. The Al Jazeera attacks ran across 2024 and 2025, so a search limited to recent weeks would miss them. Second, run the file hashes against Windows endpoints. The recovered sample was a Windows DLL, and TechCrunch describes the infected Al Jazeera devices as Windows computers.

Google has also set up Safe Browsing warnings for sites linked to the group, which gives managed browsers some protection without extra work.

Does blocking ads actually help?

Researchers say it’s the best advice available. They tell people who might be targeted to disable ad tracking or block ads, and Marczak said there is little else a person can do to protect themselves.

The logic fits the mechanics. The attack starts inside the ad, so an ad that never loads shouldn’t phone home. No one has published a test of specific blockers against this attack, so I’d treat that as reasoning, not proof. Turning off ad tracking deals with the advertising ID, but the callback also carries the IP address, so I’d rely on blocking, not tracking settings alone.

Home networks matter here. Confiant could link only a few ads straight to Candiru. Those ran at low volume and landed mostly on residential and mobile connections rather than sensitive networks. For a journalist or official working from home, a network-wide filter covers more than a per-browser extension does. A Raspberry Pi 5 running a DNS-level blocker is one inexpensive way to apply a block list to every device on the router. In an office, the same idea belongs in your DNS filtering policy.

Why vendor bans don’t close the hole

Platforms moved fast once researchers shared their findings, but the design problem remains. The ad itself carried no attack code, so the networks that delivered it had nothing malicious to detect. The decision to attack happens on Discover-Tech’s own server.

Google and IAB Europe both listed Discover-Tech as an approved vendor from 2020 until early October 2026. Google then blocked it from its ad platforms. IAB Europe suspended it from its Global Vendor List after an audit and says confirmation of the spyware findings could justify permanent expulsion. Beeswax, owned by Comcast, removed the company after independent validation by a third-party security specialist. Vungle paused its access for review, and Eskimi blocked its accounts.

None of that shut the company down. As of Thursday its site was up and said nothing about the report.

Who is actually at risk

Most readers are unlikely targets, because the server sends attack code only to devices it picks. But the reach of the ads was wide. Exposed bidding records show nearly 4 billion Discover-Tech bids on one platform between March and June 2026, with ads shown in over 70,000 apps and on upwards of 120,000 sites. They also show ads on networks linked to militaries, defense ministries, governments, national cyber agencies, critical infrastructure, NATO and other multilateral security bodies, in about two dozen countries.

That is reach, not infection. Citizen Lab says it is unclear whether any of those appearances led to a compromise. Confiant flagged potentially malicious ads on the International Criminal Court’s network and on that of the International Atomic Energy Agency, but did not say those networks were infected. Its estimate of roughly 10 million Discover-Tech ads a day is a traffic figure, not a count of malicious ads.

The method had been described before, including from leaked documents. Marczak said, as quoted by TechCrunch, that “now for the first time, we have concrete technical evidence showing this process in action.” For journalists, activists and officials, that moves ad blocking from a nice extra to a baseline.

Open questions

The biggest gap is who ordered the attacks. Citizen Lab did not say which government or governments were behind the operation. The initial exploit was never captured, and how many people outside Al Jazeera were infected, if any, is not yet reported.

Discover-Tech, Al Jazeera, Candiru’s owners and Yandex did not respond to requests for comment, so their side is unknown. The US put Candiru on a trade blacklist in 2021. In 2025, Integrity Partners, a US investment firm, acquired its assets and shifted them into a new entity reportedly called Integrity Labs, which falls outside the sanctions. Citizen Lab wants regulators to examine whether Discover-Tech, Candiru or Integrity Labs violated any laws. Whether anyone will is not yet reported.

Some details rest on one outlet. TechCrunch alone reported exposed Controlium login records that included at least two Candiru employees and some from Bindecy, plus exposed source code. It also reported that Bindecy used the platform, a claim the other outlets don’t make. And Citizen Lab’s report doesn’t appear to describe what this particular spyware can do, so don’t assume the usual capability list applies.

Frequently asked questions

Can online ads infect your device with spyware?

According to Citizen Lab, yes. It says Discover-Tech ads delivered Candiru spyware to at least 45 Al Jazeera devices in 2024 and 2025 without any action from the user. Infection took seconds, and some ads loaded out of sight.

What is the three-hop pattern?

Logs from infected devices show a connection to a Discover-Tech ad server, then to a Candiru server that screens targets, then to the server controlling the spyware. Defenders can search their own logs for that sequence.

How can I protect myself?

Researchers advise people who might be targeted to block ads or disable ad tracking. Marczak said there is little else an individual can do. IT teams should also block and search for the published indicators, such as the domain mtrtb[.]com.

Who is behind the attacks?

Citizen Lab links the infections to Candiru with high confidence and says Discover-Tech acted as a bridge to the spyware industry. It did not say which government or governments ordered the operation.

Sources

This article was compiled from reporting by the following outlets. Links go to the original reports.

1. The Guardian US Tech: Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
2. The Hacker News: Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
3. Wired: ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads
4. TechCrunch: Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware
5. PCMag: Another Good Reason to Block Online Ads: They Can Deliver Spyware
6. Bloomberg.com: Israeli Firms Placed Spyware at Al Jazeera via Ads, Report Says