Commercial spyware companies have exploited the global online advertising system to hack phones and computers, infecting dozens of devices simply by showing them an ad. Research from the University of Toronto's Citizen Lab and US cyber security company Confiant found that a new spyware-delivery technique, dubbed "Ad Fection", was used to infect devices belonging to journalists and staff at the Al Jazeera news network. Hundreds of thousands of ads run by the same network were also targeted at officials and employees at organisations including Nato, the European Commission, US chipmaker Nvidia and UK chip designer Arm.
The technology, developed by Israeli company Discover-Tech, turns the system that processes trillions of online advertising transactions every day into a covert surveillance tool. The spyware requires no interaction from the victim, distinguishing it from conventional infections that rely on persuading people to click malicious links or download infected files. "Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform," said Bill Marczak, a senior researcher at Citizen Lab.
Discover-Tech was listed as a certified advertising vendor by Google and the Brussels-based industry association IAB Europe until those organisations were shown the findings. Google said it blocked the company from its ad platforms for systematically violating its policies, while IAB suspended it from its global vendor list pending further investigation.
According to Citizen Lab, the platform was used in 2024 and 2025 to infect at least 45 devices at Al Jazeera with spyware developed by another Israeli firm, Candiru. Candiru was blacklisted by the US government in 2021. Marczak said Discover-Tech is "surely just the tip of the iceberg", noting that the online ads ecosystem gives mercenary spyware vendors a stealthy delivery system and a robust pipeline of valuable targets.
Source: Financial Times Companies · Summarized by HeadlinesBriefing