Citizen Lab Uncovers First Zero-Click Spyware Delivered via Targeted Online Ads
Mercenary hackers weaponized programmatic advertising to silently compromise media targets without user clicks.
1First Ad-Delivered Zero-Click Attack
Citizen Lab and cybersecurity firm Confiant documented the first confirmed zero-click mercenary spyware attack distributed through targeted digital advertisements. Dubbed AdFection, this campaign silently infects iOS and Android devices without requiring user interaction. Victims compromise their hardware simply by browsing regular web pages or opening standard mobile applications.
2Al Jazeera Newsroom Compromised
Researchers confirmed that forty-five devices at international broadcaster Al Jazeera were successfully breached between 2024 and 2025. The attack targeted journalists, editors, and other media staff members. The intrusions operated invisibly in the background, evading notice unless specialized mobile forensic hardware or software was deployed to detect system anomalies.
3Discover-Tech and Controlium Platform
Israel-based digital advertising firm Discover-Tech facilitated the infrastructure through its specialized software platform called Controlium. The platform enabled clients to mass-profile, track, and deanonymize millions of internet users. It secretly transmitted target IP addresses to central servers immediately after displaying seemingly benign ads for games or telecom services.
4Mercenary Spyware Integration Mechanism
Once Controlium identified an intended target, malicious payloads from Israeli mercenary spyware vendor Candiru were dispatched within seconds. The victim's browser or mobile application executed this code automatically upon loading the advertisement. The payload established secret connections back to Candiru's external servers for reconnaissance, tracking, and deep persistent infiltration.
5Global Reach Across Ecosystems
Malicious ad impressions appeared on nearly two hundred thousand websites and applications, spanning dating platforms to mainstream news outlets like CBC. Millions of global users received Discover-Tech ads starting in 2024. Confirmed distribution footprints included users located in Yemen, Brazil, Mexico, and Czechia, showing extensive cross-border surveillance capabilities.
6Ecosystem Partners Revoke Access
Following the investigation, Citizen Lab and Confiant shared technical evidence directly with commercial ad network vendors, including Google and Beeswax. Both digital exchanges promptly removed Discover-Tech from their ad marketplaces. This response severed a primary commercial programmatic pipeline used by mercenary actors to profile targets and deploy surveillance tools.
7Emerging Carrier Threat Actor
The investigation also uncovered a separate threat actor tracked as Dark Cartographer, which utilizes Discover-Tech's ad infrastructure. This actor actively exploits critical vulnerabilities across numerous global mobile telecommunications carriers. Citizen Lab announced plans to detail Dark Cartographer's specific operational methods and scope in an upcoming standalone technical research report.
8Regulatory Demands and Defenses
Researchers urged regulatory and cybersecurity agencies across the United States, Canada, and Europe to establish stricter surveillance controls on programmatic ad networks. While ad-blocking and privacy-focused browsers offer partial mitigation, Citizen Lab warned that newsrooms, civil society groups, and democratic institutions remain highly vulnerable to weaponized ad exchanges.