Just Viewing an Online Ad Can Infect Your Device With Spyware, Researchers Reveal

Simply viewing an online advertisement can be enough to infect a device with powerful spyware, without the user clicking, downloading a file, or seeing any warning.

Citizen Lab researchers documented what they call the first public technical proof of zero-click mercenary spyware delivered through targeted ads. The method, named “AdFection,” infected devices at international news network Al Jazeera with spyware linked to Israeli vendor Candiru, which now operates as Integrity Labs.

According to the Citizen Lab investigation, published on October 15, 2026, at least 45 Al Jazeera devices were targeted during 2024 and 2025. Network logs showed that infected systems first contacted Discover-Tech infrastructure after an ad was displayed. They then connected to a Candiru validation server, which checked the device, followed by a command-and-control server used by the spyware.

0-Click Spyware Infects Devices

Discover-Tech is an Israeli company that presents itself as an advertising business. Citizen Lab says it acted as a link between the online ad market and several commercial spyware groups. Its Controlium platform allowed customers to target people through mobile advertising IDs, browser cookies, and IP addresses.

Once an ad loaded, code inside it could contact a Discover-Tech server. That server decided whether the visitor was a chosen target. If the details matched, it could return JavaScript that loaded more code and began the infection process. No click was needed.

This method works because modern ads are not always simple pictures or videos. They can include code for measuring views, tracking users, and loading content from other companies.

Real-time bidding systems also share data within a fraction of a second so advertisers can decide whether to buy an ad slot. That data may include a device ID, IP address, location, and browser details. AdFection used this design to find selected devices and send code only to them, making the activity harder for ad platforms and security researchers to catch.

The scale of the operation was far larger than the confirmed infections. Researchers examined about four billion Discover-Tech bidding records covering four months in 2026.

The company’s ads appeared on almost 200,000 unique websites and Android or iOS apps across dozens of countries. Millions of devices were also quietly directed toward Candiru-linked servers, likely for tracking and checks before possible targeting. However, seeing a Discover-Tech ad does not prove that a device was infected. Most viewers were not selected to receive the spyware code.

Investigators recovered a Windows DLL from one compromised device and linked it to Candiru with high confidence. The sample used COM hijacking to remain active and a distinct 48-byte repeating XOR method to hide strings. It also contained two command-and-control domains and shared key behavior with an earlier Candiru toolchain.

Its SHA-256 hash is 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8. Readers can find more background in Cyber Security News coverage of Candiru’s DevilsTongue spyware and this guide to dangerous malware types.

Citizen Lab also connected Discover-Tech with Intelos and Bindecy. A separate actor named DARK CARTOGRAPHER reportedly used the same infrastructure to link advertising IDs with phone numbers by abusing weaknesses at mobile carriers. That activity could reveal the real identity behind an advertising profile. Citizen Lab plans to publish further technical findings about this operation in a separate report.

The findings also raise serious questions about security checks inside the advertising industry. Discover-Tech had appeared on approved or certified vendor lists and served ads through major networks, including Google, Yandex, and Beeswax. After researchers shared their findings, Google removed Discover-Tech from its advertising platforms.

IAB Europe suspended it from its approved vendor list, while Beeswax removed it from its platform. Vungle paused access, and Eskimi blocked related accounts and domains.

For users and organizations, the case shows that careful clicking alone cannot stop every infection. Security teams should block known Discover-Tech and Candiru infrastructure, inspect unusual ad-related traffic, limit advertising IDs, and use trusted ad blocking.

Browser isolation and strict controls on third-party scripts can add protection on sensitive networks. People should also reset mobile advertising IDs and turn off personalized ads when possible. Citizen Lab urged ad companies to improve vendor checks, scan ad code, share threat data, and stop unknown third parties from running code without strong review.

AdFection changes the risk around online advertising because victims may do nothing beyond opening a normal webpage or app. The confirmed Al Jazeera infections show that targeted advertising can become part of a spyware delivery chain, while the huge reach of these ads shows why the issue goes beyond one newsroom.

Stronger advertising controls, faster platform action, and better network monitoring are now needed to prevent online ads from becoming hidden paths into user devices.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.