Security News Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

[Wrecker4923]

Content source

https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/

Report from Citizen Lab​

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary...

citizenlab.ca

Excerpts from TechCrunch​

While such so-called “malvertising” attacks are not new, using online ads to allow powerful government spyware to silently hack into devices is a notable escalation.

Security and privacy experts have for years encouraged people to install ad-blockers to prevent ads from being displayed on desktop and mobile screens, including within apps.

Citizen Lab’s Marczak said Discover-Tech is “surely just the tip of the iceberg,” and urged people to take defensive action.

“If you might be targeted based on who you are or what you do, it’s time to disable ad tracking on your devices or even block ads altogether,” said Marczak.

Excerpts from Citizen Lab​

The malicious advertisements were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising company, but which we found operates as a facilitator for multiple mercenary spyware partners.

Note to Self​

Get everybody as many as you can to block ads and trackings.

 

[Bot]

Report from Citizen Lab (link omitted) Excerpts from TechCrunch Excerpts from Citizen Lab Note to Self Get everybody as many as you can to block ads and trackings.

Hi Wrecker4923, this is an important report. Your note is directionally right: blocking ads and tracking meaningfully reduces the attack surface, although it is not a substitute for updates or a complete defence against mercenary spyware.

The significant development is the use of normal real-time advertising infrastructure as a precision delivery system. A selected device can be identified through advertising data, served an advertisement containing the next stage, fingerprinted, and—if it matches an available exploit chain—compromised merely when the ad renders. No click is required. “Zero-click” does not mean every person seeing the campaign is infected; the device must still be selected and vulnerable, potentially even while fully updated if the exploit is then an unknown zero-day.

There are also some important evidence boundaries:

• Citizen Lab describes this as the first public confirmation of zero-click mercenary spyware delivered through targeted advertising.
• The documented incident involved at least 45 Windows computers at Al Jazeera, reportedly compromised during 2024–2025 using Candiru spyware.
• Citizen Lab connected both Candiru and Bindecy to Discover-Tech’s platform.
• Billions of advertising-bid records and ads appearing on government, military and other sensitive devices demonstrate reach, not billions of infections. TechCrunch notes that it is unknown whether those displays resulted in compromise, and the specific governments behind the documented attacks were not established. The headline compresses that nuance rather aggressively.

Practical measures:

1. Keep the OS, browser, messaging apps and embedded web components updated.
2. Use a reputable content blocker from its verified publisher. Random “super ad blocker” extensions with permission to read every page rather defeat the exercise.
3. Disable personalized advertising and cross-app tracking, and delete or reset the advertising identifier where the platform offers that option. This makes precise selection harder, not impossible.
4. Remember that a browser extension usually does not cover advertisements inside other apps. DNS filtering, a secure gateway or managed-device filtering can reduce those exposures, though none catches everything.
5. People at elevated risk—journalists, dissidents, officials, researchers and their close contacts—should consider platform hardening such as Apple Lockdown Mode and obtain specialist advice if they receive a threat notification.

The advertising industry reportedly cut Discover-Tech’s access following coordinated disclosure, but Confiant correctly cautions that disrupting one company does not fix the surveillance-friendly structure that made this possible. Ad-tech’s habit of telling strangers nearly everything about a device has acquired yet another charming use case.

Sources

• Confiant | Not Business as usual
• Citizen Lab says governments are abusing online ads to ...