How the ads delivered spyware

Researchers at the Citizen Lab at the University of Toronto say the Israeli advertising company Discover-Tech placed manipulated ads that could install spyware on phones and laptops without any click by the user. The technique, which the researchers call AdFection, needs nothing more than an ad loading on a website or inside an app. According to the report, the firm used real-time bidding auctions to profile and identify users before delivering malware concealed inside ordinary-looking advertisements. Citizen Lab says it examined unsecured internal data and systems of Discover-Tech and matched them against public information about known malware. The manipulated ads were reportedly shown on devices linked to the UN, NATO, the European Union and governments in many countries.

Scale of the campaign

Discover-Tech is reported to have displayed 442 million ads on more than 120,000 websites, and through partnerships it also reached more than 75,000 apps. The ads, often for everyday products such as mobile phones or headphones, looked harmless to people who saw them. Among the websites where they appeared are the BBC and the New York Times, and apps such as Duolingo, Badoo and Grindr carried them as well. Citizen Lab also found login records on the firm's website that included details of employees of Candiru, a spyware maker that the US government has placed on a blacklist. The ads also reached networks linked to the Pentagon and the International Court of Justice. The 442 million figure is described as reported, so the exact number of affected users is not known.

Websites (more than)120,000

Apps (more than)75,000

Websites (more than)

120000 count

Apps (more than)

75000 count

Data from the article text

Al Jazeera and other targets

Citizen Lab concluded that at least 45 devices belonging to Al Jazeera were infected in 2024 and 2025 through ads that delivered spyware attributed to Candiru. The researchers say these infections happened through advertising, with no click needed from the victims. Al Jazeera gave the researchers internal log data, which allowed the attacks to be traced. The report also names the foreign ministry of Saudi Arabia as a further target, based on technical traces, and the Saudi embassy had not answered a request for comment at the time of reporting. Attempted attacks were also recorded against networks of NATO and the UN, the European Parliament, the European Commission and Nordic states including Denmark, Norway and Sweden. The report adds that defence and security sectors, critical infrastructure and university networks were affected too.

Google and Confiant respond

Google said it blocked Discover-Tech from its ad platforms because the firm systematically violated its policies, and it has also suspended the company from its global vendor list. The step followed a joint investigation with Citizen Lab and Confiant, a New York ad-security company. In its own report, Confiant wrote that ads tied to Candiru made up only a tiny fraction of Discover-Tech's total ad volume. Citizen Lab's report says Discover-Tech presented itself as a legitimate advertising firm while acting as a bridge to the mercenary spyware market.

What the researchers say

Bill Marczak, a senior Citizen Lab researcher, described the method in stark terms.

“AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet.”

Citizen Lab stresses that an ad appearing on a device does not automatically mean the device was infected, though at least data was collected to build user profiles. Wolfie Christl, another senior Citizen Lab researcher, called the risk a nightmare scenario.

“The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario.”