AI News Feed
Market watch
United Adds Starlink Wi-Fi Flight Tracker as Service Reaches Nearly Half of Daily DeparturesTiny11 Builder Redesigned With WinUI 3 to Simplify Windows 11 De-BloatingiPhone Duo’s Replaceable Inner Display Layer May Help Justify $1,999 PriceApple expected to launch touchscreen OLED MacBook Pro and more at October 28 eventBank of America Hired 1,000 Contractors to Patch Flaws Exposed by AI Models, CEO SaysEiliko Robot Toy Exposed Private Chats and Child Profiles on Unsecured Chinese Servers, The Verge Reports
United Adds Starlink Wi-Fi Flight Tracker as Service Reaches Nearly Half of Daily DeparturesTiny11 Builder Redesigned With WinUI 3 to Simplify Windows 11 De-BloatingiPhone Duo’s Replaceable Inner Display Layer May Help Justify $1,999 PriceApple expected to launch touchscreen OLED MacBook Pro and more at October 28 eventBank of America Hired 1,000 Contractors to Patch Flaws Exposed by AI Models, CEO SaysEiliko Robot Toy Exposed Private Chats and Child Profiles on Unsecured Chinese Servers, The Verge Reports
Cybersecurity

Citizen Lab says online ads were used to deliver zero-click spyware

Citizen Lab says online ad networks were abused to deliver zero-click spyware, including attacks on Al Jazeera devices.

AI News Feed · 2026-10-15 21:45

Citizen Lab said Discover-Tech presents itself as a legitimate advertising firm but serves as a “bridge between ad vendors and the mercenary spyware ecosystem.” At least two makers of zero-click spyware, Candiru and Bindecy, used Discover-Tech’s platform to target people, according to the report. Both provide surveillance products that can infect devices without the victim opening a message or clicking a link.

One attack affected at least 45 Windows computers at media organization Al Jazeera, TechCrunch reported. The devices were apparently hacked in 2024 and 2025 through Candiru’s spyware after being exposed to online ads containing malicious code. Citizen Lab said it was not clear which governments were behind the attacks.

“There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” Bill Marczak, a Citizen Lab senior researcher, said ahead of the report’s release. Hackers have long sought to abuse advertising networks because they can reach almost any internet-connected device. Ad networks are designed to target ads to certain people, devices and organizations, but they can also be abused to send malicious code to specific targets. Such “malvertising” attacks are not new, but using online ads to deliver powerful government spyware is an escalation.

The researchers said Discover-Tech’s platform, called Controlium, left some source code exposed on its login pages, allowing them to recreate its web-based control panel dashboard without logging in. The dashboard “appears to be specifically designed to allow them to push malicious content to individual targeted users alongside advertisements,” they said. Citizen Lab also found a publicly accessible part of Discover-Tech’s site that allowed researchers to download login records for the Controlium dashboard without a password. Some belonged to at least two Candiru employees and some to Bindecy, according to the report.

The researchers found billions of ad bidding records exposed on Discover-Tech’s website, showing its ads were displayed across tens of thousands of mobile apps and websites between March and June 2026. The records showed ads appeared on devices used by militaries, governments, critical infrastructure and national cyber agencies. It was unclear whether the displayed ads resulted in a compromise or infection. Confiant, an ad quality platform that worked with Citizen Lab, said it found evidence that potentially malicious ads were similarly shown on devices on the networks of the International Atomic Energy Agency and the International Criminal Court.

Engadget reported that the spyware has been dubbed “AdFection” and can infect phones and computers just by showing an ad, with no need for a click. It reported that the technology was used to target journalists and staff at Al Jazeera, along with officials and employees at NATO, the European Commission, NVIDIA and Arm. Discover-Tech’s software used the real-time bidding system to profile and de-anonymize users before targeting them with spyware, and victims were sent malicious code buried in innocent-looking ads, Engadget reported. It said Discover-Tech displayed 442 million ads on more than 120,000 websites, including the BBC and The New York Times, and on apps including Duolingo, Badoo and Grindr.

Google said it suspended Discover-Tech from its ad platforms after a joint investigation with Citizen Lab and Confiant. “Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies,” the company said in a statement. Marczak said Discover-Tech is “surely just the tip of the iceberg” and urged people who might be targeted to disable ad tracking on their devices or block ads altogether. Al Jazeera did not respond to a request for comment about the hacks. Discover-Tech did not respond, and Candiru maker Integrity Labs could not be reached for comment.