Zero click spyware through ads is now documented in public technical evidence: Citizen Lab said on October 15, 2026 that Discover-Tech used targeted advertising to profile devices and enable mercenary spyware infections.
Citizen Lab published Report 195 on October 15, 2026, and The Verge and Wired reported the same day that the Israeli-founded ad tech firm Discover-Tech was linked to spyware delivery through online ads. Citizen Lab said Google removed Discover-Tech from ad vendor registries and terminated access to Google ad exchange platforms in the first week of October 2026.
What changed on October 15
Citizen Lab said its October 15 report is the first technical demonstration that mercenary spyware is being distributed through targeted advertisements. The report names Discover-Tech, its Controlium platform and Candiru, an Israeli spyware developer that Wired described as linked to the infections. The Verge reported that Discover-Tech presented itself as a typical online advertising agency while researchers said it provided a pipeline for hacking groups.
The known victim evidence centers on Al Jazeera. Wired reported that Citizen Lab concluded 45 devices belonging to the Qatar-based news outlet were targeted during 2024 and 2025 with zero-click attacks delivered by ads. The Verge described the figure as "at least" 45 devices, which is the safer reading because the supplied evidence does not prove a complete victim count.
Wired quoted Bill Marczak, a senior researcher at Citizen Lab, saying, "AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet." Marczak added, "Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all."
How zero click spyware through ads works
A zero-click ad attack uses normal ad delivery as the contact point. Citizen Lab says Discover-Tech's Controlium platform let mercenary partners de-anonymize, fingerprint and automatically infect devices when an ad was displayed, using identifiers such as IP address, mobile ad ID or browser identifier to select a target.
The mechanism depends on real-time bidding, the automated auction that decides which ad appears in an app or on a website. Wired reported that Citizen Lab analyzed ad-bidding records publicly exposed on Discover-Tech's website and found Discover-Tech-linked ads with attacker script tags in more than 70,000 mobile apps and more than 120,000 websites between March and June 2026. Wired also reported that researchers estimated millions of devices were directed to Candiru servers for profiling, while not every ad impression was necessarily weaponized.
That distinction matters for anyone reading logs. An ad impression connected to Discover-Tech does not prove a spyware infection, and the supplied evidence does not identify the exploit chain, operating systems, app versions or browser versions used against Al Jazeera devices. What Citizen Lab says it found is the delivery and profiling pipeline: infected devices had contact with domains linked to Discover-Tech and then connected to infrastructure associated with Candiru, according to Wired's account of the analysis.
Where platforms cut off Discover-Tech
Google, IAB Europe, Beeswax, Vungle/Liftoff and Eskimi took action against Discover-Tech after the Citizen Lab and Confiant investigation, according to Citizen Lab's own report. Google's action is the most dated in the evidence: Citizen Lab says Google removed Discover-Tech from ad vendor registries and terminated access to ad exchange platforms in the first week of October 2026. Wired reported that Google also set up Safe Browsing warnings for websites linked to the group.
| Organisation | Action described in the evidence |
|---|---|
| Removed Discover-Tech from ad vendor registries and terminated access to Google ad exchange platforms in the first week of October 2026, according to Citizen Lab. | |
| IAB Europe | Wired reported suspension from the Global Vendor List; IAB Europe's own notice says Discover-Tech had been on the TCF Global Vendor List. |
| Beeswax | Wired reported that the Comcast-owned ad company removed Discover-Tech after recent activity and third-party validation. |
| Vungle/Liftoff | Citizen Lab says Vungle told researchers on October 12, 2026 that it had paused all Discover-Tech access while reviewing. |
| Eskimi | Citizen Lab says Eskimi took action to disconnect Discover-Tech from parts of the digital advertising ecosystem. |
The source record is broad but uneven. Citizen Lab lists more platform actions than The Verge's account, while The Verge names Google, Beeswax and IAB Europe and attributes some removal detail to Reuters. IAB Europe's own October 15 notice is narrower than the news reports: it says IAB Europe is aware of the Citizen Lab and Confiant publications and confirms that Discover-Tech had been on the Transparency & Consent Framework Global Vendor List, but the supplied summary does not quote IAB Europe announcing a final expulsion.
What ad teams should check now
Publishers, app owners and media buyers should treat Discover-Tech as a vendor-risk and supply-chain audit, not only a security story. Check CMP settings for the IAB Europe Transparency & Consent Framework vendor list, ad server demand partners, mediation partners, DSP allowlists, ads.txt, app-ads.txt and sellers.json for Discover-Tech or related seller paths. For app inventory, pull exchange and SDK partner reports for March through June 2026, the period Wired says included the exposed bidding records analyzed by Citizen Lab.
Search and marketing teams should not infer a Google ranking penalty from this evidence. The documented search risk is indirect: Google set Safe Browsing warnings for websites linked to the group, and a warning can interrupt user access, ad traffic and conversion measurement even when organic crawling and indexing are unchanged.
That inference matters because marketing teams often separate SEO, paid media and site security. The evidence does not say Google demoted publishers that unknowingly displayed Discover-Tech ads, and it does not say ads on a publisher page infected Googlebot. It does support a narrower action: if Safe Browsing, browser interstitials, ad quality flags or DSP blocks appear for a domain, the ad supply chain should be investigated alongside malware scans and tag audits.
What evidence is still missing
The public evidence does not identify every infected person, every exploit, every app or every publisher site that displayed Discover-Tech-linked ads. Discover-Tech and Integrity Partners did not respond to Wired before publication, and the supplied evidence does not include a denial, admission or technical rebuttal from either company. The next triggers to watch are IAB Europe's final status decision on Discover-Tech's Global Vendor List entry and the outcome of Vungle/Liftoff's pause, which Citizen Lab says began after Vungle's October 12, 2026 notice to researchers.