Zero-Click Spyware Is Being Delivered Through Online Ads

Citizen Lab researchers say commercial spyware has been delivered through online advertising infrastructure, enabling attacks that may not require victims to click a malicious link.

What happened

The research links an advertising platform from Israeli company Discover-Tech to spyware vendors including Candiru and Bindecy. Citizen Lab says one campaign was associated with dozens of Windows computers at Al Jazeera that were reportedly compromised during 2024 and 2025 after exposure to malicious advertising. The technique exploits the ability of ad systems to identify and reach specific users or devices. The findings concern targeted surveillance operations rather than ordinary advertising malware, and attribution relies on Citizen Lab's technical analysis.

Why it matters

Online advertising infrastructure is built to identify users precisely and deliver content to them at scale. The same targeting capabilities can apparently be repurposed to reach selected surveillance targets, widening the attack surface beyond email, messaging and malicious links.

The bigger picture

The finding creates a security problem for the ad-tech ecosystem itself. Platforms may need stronger controls over who can buy highly targeted access and how creative payloads are inspected. It also shows how commercial surveillance tools continue to adapt around existing security defences.