Yes—an online ad can be part of a spyware attack even when nobody clicks it. An ad slot can load code that identifies a visitor, checks whether the device matches a target, and then serves exploit code in the browser or app. In the case documented by the University of Toronto’s Citizen Lab, the ad could run in the background while the page or app was simply displaying it.
What Citizen Lab confirmed
On October 15, 2026, Citizen Lab published Report 195, Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware. The lab described it as the first public technical confirmation of mercenary spyware delivered through targeted advertising without a click.
As an Amazon Associate I earn from qualifying purchases.
The investigation linked the activity with high confidence to infections by Candiru spyware on Al Jazeera devices. Citizen Lab’s report states: “This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.”
Free tools Windows power users keep installed
One-click scans. No signup required.
The finding changes how an ad impression should be viewed. Advertising systems already process network and device signals to decide which campaign to show. In this case, those same signals were used to decide who should receive an exploit.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
How an ad impression became an attack
- Discover-Tech entered the ad auction. It won placements for apparently ordinary advertisements on websites and inside Android and iOS apps.
- The ad requested remote JavaScript. When the placement rendered, code in the ad contacted infrastructure controlled by Discover-Tech. A person did not need to click, tap or interact with the creative.
- The server profiled the visitor. It could use the public IP address, advertising identifiers, cookies, browser details and operating-system information, along with targeting data, to determine whether the device fit a customer’s target list.
- Only selected visitors received the dangerous response. The server could return benign code to most people while sending malicious JavaScript to a narrow group. Eskimi told Citizen Lab that campaigns were sometimes limited to very small IP ranges and that the code varied according to the device, IP address and location.
- The exploit ran in the browser or app. The selected JavaScript attempted to exploit the device. In some cases an ad could render in the background, so the victim might never see an unusual page or prompt.
- The infection contacted spyware infrastructure. Al Jazeera network records showed traffic moving from Discover-Tech infrastructure to a Candiru validator server and then to Candiru command-and-control systems.
Why a harmless-looking ad could evade checks
The visible advertisement did not necessarily contain the exploit. The report says the ad could load code only after contacting Discover-Tech’s servers, allowing the malicious response to be selected at delivery time. That separation made the creative appear benign to ad platforms and verification systems that inspect the submitted advertisement rather than every response returned to every viewer.
What the evidence shows about victims and scale
| Finding | What it establishes | Qualification |
|---|---|---|
| At least 45 Al Jazeera devices | Network logs connected ad impressions with Discover-Tech, a Candiru validator and Candiru command-and-control infrastructure. | The devices were targeted during 2024 and 2025; Citizen Lab published the analysis in 2026. |
| Four billion Discover-Tech bidding records | The company’s activity appeared across a very large advertising dataset. | The records covered ads on almost 200,000 unique websites and Android and iOS apps in dozens of countries; the count is analyzed bidding data, not a count of infections. |
| Millions of devices directed to profiling and infection servers | Discover-Tech infrastructure had a broad reach for collecting information and routing traffic. | The report does not say that every contacted device was infected. |
The confirmed Al Jazeera case is therefore narrower than the overall advertising footprint. Technical evidence ties at least 45 devices to the spyware delivery path, while the broader records show how the platform could reach and classify devices at substantial scale.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
The companies and ad-tech connections described in the report
Discover-Tech, an Israel-based company led by CEO Dekel Boni, operated Controlium as a control-panel-style platform for mercenary spyware customers. Citizen Lab linked that platform to Candiru, reported as owned by U.S.-based Integrity Labs, as well as Bindecy and Intelos.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Discover-Tech appeared on “certified” or “approved” vendor lists maintained by Google and IAB Europe and served ads through networks including Google, Yandex and Beeswax. The report also describes identity syncing, a standard ad-tech process that can correlate the same user or device across different vendors. In this case, that capability could help an operator keep a target identifiable as the person moved between sites and apps.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download] | Includes Scam Protection, Advanced VPN, Dark Web Monitoring, & PC Cloud Backup](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
How the advertising industry responded
Citizen Lab reported several platform actions after the activity was identified:
- Google terminated Discover-Tech’s access to its ad-exchange platforms and deployed Safe Browsing protections for known actor-controlled domains.
- Beeswax removed Discover-Tech from Buyer Cloud.
- Vungle, part of Liftoff, paused access while it reviewed the activity.
- Eskimi blocked the company’s accounts and domains.
These measures address the identified infrastructure and accounts. They do not mean that every ad network has the same controls or that all historical ad responses can be retroactively inspected.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
What the incident means for people who never click ads
A click is not the boundary between advertising and security risk. Loading an ad can expose identifiers and trigger network requests before a user interacts with the page. Modern browsers and mobile operating systems often isolate web content, but a browser or app vulnerability can still turn specially crafted script into a compromise.
The practical risk depends on several conditions: whether the device is vulnerable, whether the malicious response reaches it, how narrowly the operator targets victims, and whether security controls block the exploit or its later connections. Most ad impressions in the documented dataset were not shown to have caused infection.
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Defenses for individuals and organizations
Citizen Lab recommends blocking online advertising and tracking at organizational gateways and on work-issued or edge devices, and opting out of ad targeting through device management where possible. Defenses differ in coverage:
| Control point | Scope | Third-party ad and tracking requests | Central policy enforcement | Maintenance considerations |
|---|---|---|---|---|
| Browser or device blocker | One browser or device | Can block requests matched by local lists or rules | Limited unless devices are managed | Lists and software need regular updates |
| Managed device configuration | Enrolled workstations and phones | Can apply approved settings and disable ad-targeting features | Strong for devices under an organization’s control | Requires enrollment, policy design and exception handling |
| Gateway or DNS/network filtering | Multiple users and devices behind the gateway | Can stop known ad, tracking and malicious domains before content loads | Strong, including for devices that cannot run local tools | Rules, encrypted traffic coverage and false positives require monitoring |
Practical steps for a personal device
- Keep the operating system, browser and apps on supported versions and install security updates promptly.
- Use a reputable content-blocking or privacy control that can block third-party advertising and tracking requests, not merely hide the ad image.
- Disable personalized advertising or reset the advertising identifier in the device’s privacy settings where those controls are available.
- Be cautious with unmaintained browsers, sideloaded apps and devices that no longer receive security patches.
Practical steps for an organization
- Apply ad and tracker blocking at a managed gateway or DNS layer so coverage is not limited to one browser.
- Enforce browser, operating-system and app updates through device management.
- Restrict unmanaged or outdated devices from sensitive services.
- Monitor DNS, proxy and endpoint telemetry for unexpected connections to newly registered or actor-controlled domains.
- Record ad-tech vendors and identity-sync services in third-party risk reviews; an approved advertising vendor can still become a route to hostile code if its account or infrastructure is abused.
What the report does not establish
Citizen Lab’s findings do not show that every ad impression caused an infection, identify every government customer, or provide a final criminal or regulatory outcome. The lab called for regulators to investigate those questions. The strongest public evidence is the technical chain observed on the Al Jazeera devices and the much larger set of bidding and profiling records that shows how the delivery model could operate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
