A single advertisement displayed on a website or app may be enough to launch a spyware attack on a device, without the user clicking on it or opening a message. This was revealed in an investigation into the exploitation of digital advertising networks to deliver spyware to specific individuals and devices.
اضافة اعلان
The University of Toronto’s Citizen Lab published a report titled Discover Advection on October 15, 2026. It was authored by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert.
On the same day, TechCrunch published a report by Zack Whittaker providing additional details about advertising records and the devices on which the ads appeared. The researchers said they had technically documented a zero-click spyware attack carried out through targeted advertising.
Ads targeting specific devices
Citizen Lab linked the attacks to Israeli company Discover-Tech, which describes itself as an advertising company. However, the researchers said it acted as an intermediary between advertising networks and commercial spyware vendors. According to the report, the company’s platform, Controlium, allowed clients to target specific devices using advertising IDs, browser identifiers or IP addresses.
According to the researchers, the process begins when an advertisement appears on a user’s device. The ad may collect information about the device and browser, then download additional code if the device is selected as a target. The code can continue scanning the device and deliver spyware without any interaction from its owner.
The report said Discover-Tech facilitated attacks using Candiru, also known as Integrity Labs, against devices on Al Jazeera Media Network’s systems in 2024 and 2025. At least 45 devices were targeted, including Windows computers. The researchers did not identify the governments behind the attacks.
Wide advertising reach
The researchers analyzed approximately four billion advertising-bid records over a four-month period and found that Discover-Tech ads appeared on nearly 200,000 websites and apps across dozens of countries. They also identified records indicating that the ads appeared on devices associated with government and military networks, critical infrastructure and cybersecurity organizations. However, the appearance of an ad on a device does not, by itself, prove that the device was compromised.
Citizen Lab researcher Bill Marczak said the investigation provided “concrete technical evidence” that advertising can be used to target and compromise devices with precision. He added that malicious ads may also have appeared on devices within networks belonging to the International Atomic Energy Agency and the International Criminal Court, based on findings from Confiant, a company that participated in the investigation.
The researchers did not confirm that these devices had been infected with spyware.
Exposed data and action by advertising companies
The investigation found that the source code for the Controlium interface was accessible through its login page, while a publicly accessible endpoint allowed researchers to download user login records without a password. According to Citizen Lab, the records included data associated with at least two Candiru employees and some users linked to Bindseye, another spyware company.
The lab said Google, IAB Europe, Beeswax, Fangle and Eskimi had taken steps to cut Discover-Tech’s access to the advertising ecosystem. Marczak also urged people who might be targeted because of their identity or work to disable ad tracking on their devices or use ad blockers.
Discover-Tech did not respond to requests for comment, while Integrity Labs could not be reached, according to TechCrunch. Representatives of Adtimize and Volasym denied involvement in the spyware activities covered by the investigation.
Source: Al-Ghad.
