How Ordinary Ads Became Zero-Click Spyware

Zero-Click Spyware is real, and it arrived through the most ordinary channel imaginable: the ad slots loading on your screen. Researchers at the University of Toronto's Citizen Lab published findings on October 15, 2026 showing that a little-known ad-tech firm, Discover-Tech, turned online advertising into a delivery pipeline for mercenary spyware — with no click, no tap and no download required.

According to the report, at least 45 devices belonging to journalists and staff at Al Jazeera were compromised this way during 2024 and 2025. The researchers describe it as the first publicly confirmed case of mercenary spyware delivered through targeted advertising, a technique they named AdFection. Simply having the ad render on screen was enough to start the infection, which makes Zero-Click Spyware a fundamentally different threat from the phishing links most security advice covers.

The mechanism hides inside the machinery of programmatic advertising. When you open a site or an app, the ad slot is auctioned in under a second, and bidders receive details about your device — things like an advertising ID and an IP address. The Israeli ad-tech firm at the center of the case bid aggressively in those auctions through its own buying platform, then used the winning slots to profile devices and pick targets. For almost everyone, the ad looked harmless and nothing happened. For a chosen few, the ad quietly handed their device to spyware servers.

How an ad became an attack

Zero-Click Spyware needed two ingredients: a way to find the right devices and a way to infect them silently. The buying platform, called Controlium, offered customers precise targeting by mobile advertising ID, browser cookie or IP address. Once a match appeared, the system could fingerprint the device, and a tiny invisible frame inside the ad connected it to screening servers run by Candiru, a commercial spyware maker.

Candiru's servers vetted each device before passing it along to exploit servers, completing the chain from ad render to full compromise. Researcher Bill Marczak told Wired that operators could "automatically hack specific individuals" while they browsed or used apps, potentially without them interacting with the ad at all. Infected Windows machines gave operators deep access to files and activity. Security Affairs summarized the technical report, noting the lab's finding that the ad-buying platform let surveillance vendors profile millions of devices before choosing their targets.

The scale of the underlying infrastructure was enormous. Between March and June of 2026, the firm's buying platform bid on nearly 3.77 billion ad impressions and won roughly 442 million of them. Reporting on the investigation notes the ads appeared across more than 120,000 websites and over 70,000 mobile apps, on networks used by militaries, governments and international institutions as well as ordinary readers. The researchers stress, however, that seeing one of these ads does not prove a device was targeted or infected — most impressions were benign, a caveat that matters before anyone panics.

What it means for everyone else

Zero-Click Spyware changes the old security advice. "Don't click suspicious links" still matters, but AdFection worked precisely because it removed the click from the equation. The target did everything right — opened a normal app, read a normal page — and the attack still arrived.

For ordinary users, the direct risk is low. This was a targeted operation aimed at journalists, and running it at scale against random people would be expensive and noisy. But the profiling machinery is the part that affects everyone: millions of devices touched infrastructure that could fingerprint them, whether or not they were ever selected. That is the quiet trade embedded in the modern ad economy — the data collected to serve you a relevant ad can also be used to decide you are worth hacking.

The fallout has been swift. Google removed the ad-tech firm from its ad platforms and vendor lists, and a European ad-industry body did the same, after the findings went public. An ad-security firm published a parallel investigation the same day, finding the company's ads on networks used by sensitive institutions. Candiru, which the United States placed on its trade blacklist in 2021, has since rebranded under a new name. Neither the ad-tech firm nor the spyware maker responded to the researchers' requests for comment.

The news network's own technology team first noticed something wrong in 2024, when unusual traffic appeared on some journalists' devices. The network asked the researchers to investigate, and that trail — device, ad server, screening server, command server — became the backbone of the report. Press-freedom advocates called the campaign an assault on journalism and said those responsible must be held accountable.

Zero-Click Spyware delivered through ads is now a documented threat, not a hypothetical one, and it sits alongside a wider wave of institutions pushing back against untrusted AI systems and the breakneck release of powerful open models. The fix will not come from users alone; it will need ad platforms, regulators and device makers to close the gap between an auction bid and a silent infection.