Researchers say an Israeli ad broker turned banner inventory into a zero-click spyware pipeline

Citizen Lab Report 195, published 15 October by the University of Toronto and authored by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert, describes what the researchers call “AdFection”: the first public technical confirmation, they say, of a zero-click mercenary spyware attack delivered through targeted online advertising. The malicious ads were purchased by Discover-Tech, an Israeli company that presents itself as a conventional advertising business but which the report says intentionally operates a platform allowing its “partners to de-anonymize, fingerprint, and automatically infect devices.” The spyware came from Candiru, now rebranded as Integrity Labs and blacklisted by the US government. Confiant, a New York advertising-security firm, published a separate parallel report the same day. Citizen Lab says the ads reached more than 120,000 websites and 75,000 apps across dozens of countries over a four-month period.

Reuters, in coverage carried by Dawn and TimesLIVE, reported that Discover-Tech’s services gave Candiru and other Israeli surveillance firms access to advertising platforms operated by Google, Comcast, Russia’s Yandex and others. Citizen Lab says Google, IAB Europe and Beeswax have cut off Discover-Tech; we have not seen confirmation that Comcast or Yandex did the same. Devices at Al Jazeera were infected — at least 45 of them, according to Ground News’s summary of the research, a figure that comes from the researchers rather than from the network itself. The report also warns the ads endangered “national-security-sensitive networks” including government ministries, armed forces and multilateral organisations such as NATO. Marczak told the Financial Times, as reported by Engadget, that “Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform.” We have not seen a response from Discover-Tech or from Candiru/Integrity Labs.

Assessment: Two things to hold apart. Discover-Tech is an ad broker; Candiru is the spyware vendor. Several aggregators are collapsing them into one Israeli spy firm, and that framing will outrun the evidence. The second caution is the victim list: Al Jazeera has not itself confirmed the 45 devices, and the NATO, European Commission, NVIDIA and Arm names reach us via Engadget’s reading rather than quoted report text. What is solid is structural. The real-time bidding stack — which exists to fingerprint and target devices at scale — is functionally indistinguishable from reconnaissance infrastructure. Three intermediaries severing ties within hours of publication is the most telling detail: it suggests the ecosystem knew it could not defend the access it had sold.