Security researchers at the University of Toronto's Citizen Lab have confirmed the first technical evidence of zero-click spyware being delivered through ordinary online advertisements. In a report published on October 15, 2026, the lab revealed that an Israeli company called Discover-Tech operated as a bridge between global ad networks and mercenary spyware makers, letting them profile and hack almost any device.
The investigation, carried out with the ad quality platform Confiant, shows how malicious ads purchased through Discover-Tech infected at least 45 Windows computers at the Qatar-based network Al Jazeera in 2024 and 2025. The targets did not have to click a link or open a file. Researchers call the technique AdFection, and say the case signals a systemic risk for anyone using a phone, laptop, or smart device.
How Discover-Tech's Controlium platform works
Discover-Tech markets itself as a legitimate advertising firm and appeared on approved vendor lists maintained by Google and the advertising industry body IAB Europe. According to Citizen Lab, the company ran a hidden platform named Controlium that gave spyware partners tools to de-anonymize internet users, fingerprint their devices, and choose targets for infection using an IP address, mobile ad ID, or browser identifier.
Once a target was selected, the malicious ad would trigger automatically as soon as it rendered in a browser or app. That makes it a zero-click attack, meaning the victim takes no action at all. Discover-Tech's ads were served through major ad exchanges including Google, Yandex, and Beeswax, and also exploited GDPR consent pop-ups to reach users inside the European Union.
Scale of the Discover-Tech ad campaign
The researchers analyzed four billion ad bidding records that Discover-Tech had left publicly exposed on its website, according to TechCrunch. Over a four-month period between March and June 2026, the company's ads appeared on almost 200,000 unique websites and Android and iOS apps across dozens of countries. Some ads silently steered millions of devices toward servers belonging to Candiru, the Israeli spyware maker now rebranded as Integrity Labs, which is blacklisted by the US government.
