Spyware Vendors Exploit Adtech Networks for Zero-Click Attacks
Ad networks are being weaponized to deliver spyware without requiring user interaction.
1Weaponized Adtech Infrastructure
Researchers at Citizen Lab identified a critical vulnerability where ad networks serve as delivery vehicles for mercenary spyware. The technique, dubbed AdFection, enables zero-click attacks, meaning users are compromised simply by loading a webpage or app. This bypasses traditional security measures that typically require users to click suspicious links or download malicious files.
2The Role of Discover-Tech
The Israeli firm Discover-Tech allegedly acted as a bridge between the advertising industry and spyware vendors like Candiru. By masquerading as a legitimate adtech company, they gained access to major advertising exchanges. Citizen Lab reports that this firm functioned primarily as a front for large-scale espionage rather than standard digital advertising operations.
3Exploiting Real-Time Bidding
The attack leverages the real-time bidding system used to display ads on websites and mobile applications. When a page loads, the system broadcasts device and location data to potential bidders. Discover-Tech allegedly used this granular data to identify specific targets, subsequently serving them malicious ads to facilitate the installation of spyware on their devices.
4Targeting Al Jazeera Staff
Citizen Lab confirmed that at least 45 devices belonging to Al Jazeera staff were compromised between 2024 and 2025. These infections were traced back to Candiru spyware delivered through ads managed by Discover-Tech. This incident highlights how targeted advertising can be weaponized to compromise high-profile individuals without their knowledge or any direct interaction.
5Systemic Vetting Failures
Discover-Tech maintained status as an approved vendor with Google and IAB Europe since 2020. Despite the firm's malicious activities, these organizations failed to detect the abuse within their vetted ecosystems. The researchers analyzed nearly four billion ad-bidding records, revealing that the firm's ads appeared on over 70,000 mobile apps and 120,000 websites.
6Broad Network Exposure
Between March and June 2026, malicious ads reached networks associated with government agencies, defense organizations, and NATO. While there is no current evidence of successful infections within these specific high-security networks, the ads were capable of profiling devices. This demonstrates the immense scale and reach of the compromised advertising delivery infrastructure.
7Industry Response and Cleanup
Following the disclosure, Google terminated Discover-Tech's access to its advertising exchanges and removed the firm from its approved vendor lists. IAB Europe, Beeswax, Vungle, and Eskimi also took immediate action to block the company. These measures aim to mitigate further risks, though the incident underscores ongoing structural weaknesses in digital advertising security.
8Structural Industry Implications
The findings expose deep-seated flaws in the online advertising industry, which allowed commercial surveillance operators to exploit its ecosystem for years. This case shifts the narrative from privacy concerns regarding shopping habits to active security threats. It necessitates a fundamental re-evaluation of how adtech platforms vet participants and protect user data integrity.