How Online Ads Became Spy Tool For Israel
An online advert can become a hidden doorway into a device. An investigation into zero-click spyware attacks shows how targeted digital ads can help surveillance operators reach people without asking them to click a link or download a file.
In a report on October 15, 2026, Citizen Lab, a University of Toronto research group, linked Israeli ad company Discover-Tech to spyware vendors. Researchers called the technique “AdFection” and said it was the first publicly confirmed case of mercenary spyware delivered through targeted ads.
How the attack works
Automated ad auctions can provide information like device identifiers to bidders when they open a website or app, along with an IP address and approximate location. They believe Discover-Tech employed its Controlium platform to recognise specific devices and send some ads to servers connected to an Israeli spyware firm, Candiru, which was blacklisted by the U.S. government in 2021.
The advert might need to be loaded. It can send a device code that will take advantage of software vulnerabilities. Spyware can read messages, emails, files, view browser data, or operate the microphone and/or camera. Several weaknesses may be necessary for a successful attack and a device with an ad displayed does not necessarily exist.
The scale of the risk
Almost four billion exposed ad-bid records were analysed by Citizen Lab. Between March and June 2026, it discovered Discover-Tech ads on over 120,000 websites and 70,000 mobile applications. Between 2024 and 2025, researchers found that 45 Al Jazeera Windows devices were infected with the Candiru spyware.
The ads were also printed on networks that are utilized by the United Nations, NATO and the European Union institutions in addition to government and media networks in many countries. Not all of these locations were sites of infection. Ad-security company Confiant estimated that Discover-Tech served at least 10 million ads daily – reaching potentially hundreds of millions of people.
What needs to change?
Google has now banned Discover-Tech from its ad platforms due to violating its policies. It was suspended from its approved-vendors list by IAB Europe and its ad-tech arm, Comcast’s Beeswax, took it off. Reuters‘ requests for comment were not answered by Discover-Tech or Candiru.
While rarely encountered by most, attacks are more dangerous for journalists, high-ranking officials and other vulnerable users. They recommend having a trusted Ad blocker, restricting or resetting mobile advertising IDs, using privacy-focused browsers and ensuring that devices are kept up to date. Organisations should also block any ads that might be considered risky on work devices and keep a check on any suspicious ad traffic.
The message of the lesson is clear – online advertising is not just a privacy problem. If weak checks are left to let malicious ads into trusted networks, the system can be used as a covert surveillance tool. Better vetting, less sharing of personal information and more monitoring are required.
Explore the Cyber Threats, Tech Rivalries, Digital Privacy Battles, and Space Discoveries Shaping Our Future
How Can Sub-Second Exploits Threaten Global Infrastructure?
Can Cyberattacks Disrupt Russia’s 2026 Elections?
Can Threads Give Meta the Boost It Needs?
Will EU Chat Scanning Change Online Privacy?
What Could NASA’s Artemis II Mission Reveal?
