Malicious ads: how a simple ad installed spyware without a single click
On October 15, the University of Toronto’s Citizen Lab published the first technical demonstration of real-world infections by “zero-click” spyware delivered through malicious ads. The victims didn’t download or click anything: an ad simply had to appear. At least 45 devices at the Al Jazeera network were infected with Candiru spyware in 2024 and 2025. Citizen Lab named the technique AdFection.
At the heart of the case: Discover-Tech, an Israeli company presenting itself as a digital advertising agency, and its Controlium platform. According to the researchers, it acted as a bridge between spyware vendors and the major ad networks, and no legitimate advertising activity was found.
Anatomy of an AdFection in 6 steps
That’s what makes these malicious ads so hard to spot: the ad itself is ordinary, and the platform serving it never sees the malicious code. Only the chosen devices receive it.
What your device reveals with every ad
// Simplified, fictional ad request, inspired by the OpenRTB format
What each line says about you
- 1The app or site where the ad appears (here, a weather app).
- 2The device’s advertising ID, which lets you be recognized from one app to the next.
- 3The IP address. At the office, it often reveals your company’s name: that’s how Citizen Lab saw Discover-Tech ads on the networks of ministries, NATO and large corporations.
- 4The operating system and its version: enough to pick an exploit that will work.
- 5An approximate location.
- 6Interest categories inferred from your browsing.
Illustrative example: real requests often contain many more fields.
Who should worry about malicious ads?
High-value targets
Journalists, activists, elected officials, diplomats, people in conflict with a foreign government
Real risk of infection
Exposed profiles
Executives, lawyers (intellectual property), suppliers to government, defence, energy or semiconductors, business travellers
Likely profiling, possible targeting
Everyone
Every device that displays targeted ads, at work or at home
Profiling and ad tracking
To be clear: for the vast majority of SMBs, the risk of being infected with government-grade spyware remains low. But two things concern you directly. First, the same ad machinery is used by ordinary criminals to push fake software and fake login pages, as we saw with malicious fake ChatGPT models. Second, if you work for sensitive clients (government, defence, energy, law firms), your devices can become a way in to them.
The advice from Bill Marczak, senior researcher at Citizen Lab: “If you might be targeted based on who you are or what you do, it’s time to disable ad tracking on your devices or even block ads altogether.”
10 minutes of settings, device by device
| Device | Setting | Where to find it |
|---|---|---|
| Windows 11 | Turn off the advertising ID | Settings › Privacy & security › General |
| iPhone and iPad | Refuse app tracking and Apple personalized ads | Settings › Privacy & Security › Tracking, then Apple Advertising |
| iPhone (highly exposed profiles) | Turn on Lockdown Mode | Settings › Privacy & Security › Lockdown Mode |
| Android | Delete the advertising ID | Settings › Google › All services › Ads (labels vary by manufacturer) |
| Chrome and Edge | Turn off ad topics and set tracking prevention to strict | Chrome: Privacy and security › Ad privacy · Edge: Privacy, search, and services › Tracking prevention |
| All devices | Automatic updates for the OS, browser and apps | Zero-click exploits target flaws: an up-to-date device closes doors on them |
For the business: 4 measures that don’t depend on each employee
- DNS filtering that blocks shady ad networks and malicious domains, at the office and on laptops and phones on the road.
- Central device management (for example Microsoft Intune) to enforce a disabled advertising ID, automatic updates and an approved ad blocker.
- Separate work phones for exposed profiles, without free ad-supported apps.
- Proactive monitoring of your systems, to spot connections to unknown domains or a process that has no business running on a workstation.
What we know, what we don’t know yet
✔️ What we know
- At least 45 Windows devices at Al Jazeera were infected with Candiru spyware in 2024–2025.
- Between March and June 2026, Discover-Tech placed 3.77 billion bids and won 442 million.
- Its ads appeared in 75,373 apps and 120,768 websites, including CBC, the BBC, the New York Times, Duolingo, Yahoo Mail and Viber.
- Discover-Tech was on “certified” vendor lists at Google and IAB Europe. It has been removed, and Google, Beeswax, Eskimi and Vungle cut off its access.
❓ What we don’t know
- Which governments were customers of the platform.
- How many devices were actually infected: a displayed ad is not an infection.
- Which exact flaws were exploited. Candiru has used Windows and Chrome zero-days in the past.
- How many other similar platforms exist. Citizen Lab calls it “the tip of the iceberg.”
To go further: why the browser padlock isn’t a guarantee, our managed IT services (updates and device management) and our cybersecurity services.
Book your free cyber check
In 30 minutes, we look at your devices, ad settings, DNS filtering and updates, and tell you where to start. Free, no commitment.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- The Citizen Lab (University of Toronto) — Exposing AdFection: Executive Summary (October 15, 2026)
- The Citizen Lab — How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (full report)
- TechCrunch — Governments are hacking people with ‘zero-click’ spyware by showing them online ads (October 15, 2026)
- BleepingComputer — Targeted ads installed Candiru spyware in zero-click attacks (October 16, 2026)
Photo: cottonbro studio, Pexels (Pexels licence).