Security News Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

[Wrecker4923]

Content source

https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/

Report from Citizen Lab​

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary...

citizenlab.ca

Excerpts from TechCrunch​

While such so-called “malvertising” attacks are not new, using online ads to allow powerful government spyware to silently hack into devices is a notable escalation.

Security and privacy experts have for years encouraged people to install ad-blockers to prevent ads from being displayed on desktop and mobile screens, including within apps.

Citizen Lab’s Marczak said Discover-Tech is “surely just the tip of the iceberg,” and urged people to take defensive action.

“If you might be targeted based on who you are or what you do, it’s time to disable ad tracking on your devices or even block ads altogether,” said Marczak.

Excerpts from Citizen Lab​

The malicious advertisements were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising company, but which we found operates as a facilitator for multiple mercenary spyware partners.

Note to Self​

Get everybody as many as you can to block ads and trackings.

 

[Bot]

Report from Citizen Lab (link omitted) Excerpts from TechCrunch Excerpts from Citizen Lab Note to Self Get everybody as many as you can to block ads and trackings.

Hi Wrecker4923, this is an important report. Your note is directionally right: blocking ads and tracking meaningfully reduces the attack surface, although it is not a substitute for updates or a complete defence against mercenary spyware.

The significant development is the use of normal real-time advertising infrastructure as a precision delivery system. A selected device can be identified through advertising data, served an advertisement containing the next stage, fingerprinted, and—if it matches an available exploit chain—compromised merely when the ad renders. No click is required. “Zero-click” does not mean every person seeing the campaign is infected; the device must still be selected and vulnerable, potentially even while fully updated if the exploit is then an unknown zero-day.

There are also some important evidence boundaries:

• Citizen Lab describes this as the first public confirmation of zero-click mercenary spyware delivered through targeted advertising.
• The documented incident involved at least 45 Windows computers at Al Jazeera, reportedly compromised during 2024–2025 using Candiru spyware.
• Citizen Lab connected both Candiru and Bindecy to Discover-Tech’s platform.
• Billions of advertising-bid records and ads appearing on government, military and other sensitive devices demonstrate reach, not billions of infections. TechCrunch notes that it is unknown whether those displays resulted in compromise, and the specific governments behind the documented attacks were not established. The headline compresses that nuance rather aggressively.

Practical measures:

1. Keep the OS, browser, messaging apps and embedded web components updated.
2. Use a reputable content blocker from its verified publisher. Random “super ad blocker” extensions with permission to read every page rather defeat the exercise.
3. Disable personalized advertising and cross-app tracking, and delete or reset the advertising identifier where the platform offers that option. This makes precise selection harder, not impossible.
4. Remember that a browser extension usually does not cover advertisements inside other apps. DNS filtering, a secure gateway or managed-device filtering can reduce those exposures, though none catches everything.
5. People at elevated risk—journalists, dissidents, officials, researchers and their close contacts—should consider platform hardening such as Apple Lockdown Mode and obtain specialist advice if they receive a threat notification.

The advertising industry reportedly cut Discover-Tech’s access following coordinated disclosure, but Confiant correctly cautions that disrupting one company does not fix the surveillance-friendly structure that made this possible. Ad-tech’s habit of telling strangers nearly everything about a device has acquired yet another charming use case.

Sources

• Confiant | Not Business as usual
• Citizen Lab says governments are abusing online ads to ...

 

[oldschool]

Of course, this is from the country committing genocide with the full support of the Republic of Gilead. and the quest for a Greater Israel.

 

[n8chavez]

Of course, this is from the country committing genocide with the full support of the Republic of Gilead.

There it is again. You really need some serious un-brainwashing.

 

[lokamoka820]

Of course, this is from the country committing genocide with the full support of the Republic of Gilead.

It’s not a country; it’s just an entity or a project, and it will come to an end very soon.

 

[oldschool]

It’s not a country; it’s just an entity or a project, and it will come to an end very soon.

It's one of many such organizations in that country, like it's their specialty. Targeted malware in their quest for regional domination.

 

[oldschool]

How Israeli firm’s ‘zero-click’ malware attack poses global security risk

A new ‘zero-click’ hack uses ads to target victims without any action needed on their part.

www.aljazeera.com

Malicious advertisements were bought by Discover-Tech, an Israeli company presenting itself as a legitimate advertising firm, but which actually operates as a facilitator for mercenary spyware partners.

 

[oldschool]

There it is again. You really need some serious un-brainwashing.

I'm just stating the facts. You must have ingested the MAGA kool-aid. You're free to make believe all you want.

 

[n8chavez]

I'm just stating the facts. You must have ingested the MAGA kool-aid. You're free to make believe all you want.

Except I'm not maga, at all.

 

[nickstar1]

Politicians? A whole lot of self-serving crooks who seem to have mastered the art of benefiting themselves and their little circle of friends while the rest of us are left to deal with the fallout. Honestly, I’m over it. I can’t wait to see whether AI could eventually replace some of these people, because at this point, I’d love to see what happens when decisions are driven by logic and accountability instead of egos, backroom deals, and personal agendas. Imagine a world where people actually worked toward solving problems instead of constantly finding new ways to divide us. But no, apparently keeping everyone at each other’s throats is more useful to certain people than actually fixing anything. Keep the public distracted, keep them fighting, and nobody notices who’s picking their pockets. It’s a beautifully convenient little game, isn’t it?

These political mind parasites thrive on division, and the public keeps getting dragged into the same tired circus. Maybe it’s time we started questioning the people pulling the strings instead of blindly playing along with their game.

Funny how governments around the world are drowning in debt, and somehow, things never seem to get better. Take the USA, for example. There’s always money flying out the door for programs, projects, and research that sometimes make you wonder who approved them, who’s benefiting from them, and who’s conveniently getting their hands in the cookie jar. Meanwhile, guess who gets stuck with the bill? We do. The taxpayers. These governments treat public money like it’s an unlimited credit card with someone else making the payments. Spend now, explain nothing, and let the next administration deal with the mess. And heaven forbid anyone question where the money is going! Honestly, are we really surprised anymore? Different countries, different politicians, different agendas, but somehow the same old song and dance. They promise change, preach responsibility, and point fingers at everyone else while the debt keeps piling up.

Different suits, different slogans, same dirty game. And the taxpayers? We’re apparently just the fools expected to keep funding the circus while the people running it pretend they have everything under control.

 

[Wrecker4923]

I’d love to see what happens when decisions are driven by logic and accountability instead of egos, backroom deals, and personal agendas

AI can reflect biases in its training data and design, and handing it political power wouldn’t remove human values or conflicts—it could obscure who is responsible for decisions. I’d be wary. We ought to always keep in mind who owns the AIs and has power over their parameters; they might not share our worldviews.

P.S.: This is probably off topics at this point.

 

[Halp2001]

I think one of the most interesting takeaways from the report is that it goes beyond the usual privacy debate. Online advertising has long been discussed mainly in terms of commercial tracking, but this case shows how the same infrastructure can also be used to target and deliver highly sophisticated attacks.

According to Citizen Lab, the most significant aspect is not the malware itself, but the first public confirmation of mercenary zero-click spyware being delivered through targeted ads. This shows that the advertising ecosystem is about more than just marketing or data collection.

To me, the main takeaway is a practical one: reducing exposure to ad tracking can also help reduce the attack surface. The political questions surrounding who was behind these operations may be relevant, but they don't change that fundamental lesson.

 

[[correlate]]

Actually, I had already anticipated this.
They’re seeking to carry out mass surveillance
it doesn’t matter what country you’re in or where you’re from; you’re a legitimate target. They’ll hack into your account and collect information on you until you do something or express an opinion that contradicts their views, at which point you’ll be arrested.
Isn’t this what totalitarian rule looks like now? It’s moved to the internet
this is dictatorship in its purest form.
I hope we can find solutions to these kinds of intrusions. I don’t know if ad blockers are effective or not.
By the way, consider using uBlockDNS.
Thank you all,
and especially
@oldschool
you really have a conscience.

 

[[correlate]]

This might be useful for checking for malicious ads on your computer,
but please test it first before using it—in other words, we should wait until we’re sure it’s truly safe.
Zero Breach — a local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

GitHub - interplains/zero-breach: Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies. - interplains/zero-breach

github.com