# Citizen Lab Uncovers First Zero-Click Spyware Delivered via Targeted Online Ads Mercenary hackers weaponized programmatic advertising to silently compromise media targets without user clicks. - **Source:** [BetaKit](https://betakit.com) - **Published:** 2026-10-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/bb309aab-4f26-4ff8-93cd-80751c85dc82 ## First Ad-Delivered Zero-Click Attack Citizen Lab and cybersecurity firm Confiant documented the first confirmed zero-click mercenary spyware attack distributed through targeted digital advertisements. Dubbed AdFection, this campaign silently infects iOS and Android devices without requiring user interaction. Victims compromise their hardware simply by browsing regular web pages or opening standard mobile applications. ## Al Jazeera Newsroom Compromised Researchers confirmed that forty-five devices at international broadcaster Al Jazeera were successfully breached between 2024 and 2025. The attack targeted journalists, editors, and other media staff members. The intrusions operated invisibly in the background, evading notice unless specialized mobile forensic hardware or software was deployed to detect system anomalies. ## Discover-Tech and Controlium Platform Israel-based digital advertising firm Discover-Tech facilitated the infrastructure through its specialized software platform called Controlium. The platform enabled clients to mass-profile, track, and deanonymize millions of internet users. It secretly transmitted target IP addresses to central servers immediately after displaying seemingly benign ads for games or telecom services. ## Mercenary Spyware Integration Mechanism Once Controlium identified an intended target, malicious payloads from Israeli mercenary spyware vendor Candiru were dispatched within seconds. The victim's browser or mobile application executed this code automatically upon loading the advertisement. The payload established secret connections back to Candiru's external servers for reconnaissance, tracking, and deep persistent infiltration. ## Global Reach Across Ecosystems Malicious ad impressions appeared on nearly two hundred thousand websites and applications, spanning dating platforms to mainstream news outlets like CBC. Millions of global users received Discover-Tech ads starting in 2024. Confirmed distribution footprints included users located in Yemen, Brazil, Mexico, and Czechia, showing extensive cross-border surveillance capabilities. ## Ecosystem Partners Revoke Access Following the investigation, Citizen Lab and Confiant shared technical evidence directly with commercial ad network vendors, including Google and Beeswax. Both digital exchanges promptly removed Discover-Tech from their ad marketplaces. This response severed a primary commercial programmatic pipeline used by mercenary actors to profile targets and deploy surveillance tools. ## Emerging Carrier Threat Actor The investigation also uncovered a separate threat actor tracked as Dark Cartographer, which utilizes Discover-Tech's ad infrastructure. This actor actively exploits critical vulnerabilities across numerous global mobile telecommunications carriers. Citizen Lab announced plans to detail Dark Cartographer's specific operational methods and scope in an upcoming standalone technical research report. ## Regulatory Demands and Defenses Researchers urged regulatory and cybersecurity agencies across the United States, Canada, and Europe to establish stricter surveillance controls on programmatic ad networks. While ad-blocking and privacy-focused browsers offer partial mitigation, Citizen Lab warned that newsrooms, civil society groups, and democratic institutions remain highly vulnerable to weaponized ad exchanges. ## Sources covering this story - [BetaKit — Citizen Lab Uncovers Zero-Click Ad-Based Spyware Attack](https://betakit.com/u-of-ts-citizen-lab-exposes-nightmare-spyware-hack-that-requires-no-clicks-from-users/) - [Slashdot — First Public Confirmation of Ad-Delivered Zero-Click Spyware](https://tech.slashdot.org/story/26/10/15/1822259/first-ever-public-confirmation-of-zero-click-spyware-delivered-via-targeted-ads?utm_source=rss1.0mainlinkanon&utm_medium=feed) - [Biz & IT - Ars Technica — Mercenary Malware Delivered via Targeted Zero-Click Ad Exploits](https://arstechnica.com/security/2026/10/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware/) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._