A joint investigation by Citizen Lab and Confiant alleges that an advertising platform called Controlium was used to profile devices and help deliver commercial spyware through targeted ads. The findings raise serious questions about the security of digital advertising and the protection of online privacy.
On October 15, 2026, researchers at the University of Toronto’s Citizen Lab published an investigation into a sophisticated method for distributing spyware through online advertising. The investigation, conducted with advertising-security company Confiant, describes a system that could use ordinary advertising infrastructure to identify specific devices and expose them to cyberattacks.
The report is titled “Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware.” According to the researchers, a company called Discover-Tech and its Controlium platform played a role in connecting targeted advertising with commercial spyware operators.
The most concerning element is the alleged use of “zero-click” attacks. These are attacks in which a victim does not need to click a link, download a file or open a message to be exposed to the exploitation of a technical vulnerability.
Researchers documented the use of this method against devices at Al Jazeera during 2024 and 2025. They identified at least 45 devices at the media organization that were reportedly compromised by spyware linked to Candiru.
The findings do not mean that every online advertisement is dangerous. They do show, however, that advertising infrastructure can be abused in ways that go well beyond conventional malicious advertisements.
How does a zero-click attack work?
In a traditional phishing attack, a criminal tries to trick someone into clicking a link, opening a document or providing login credentials. A zero-click attack may not require any such action.
If a device contains an exploitable vulnerability and receives specially crafted content, an attacker may be able to execute malicious code without obvious user interaction. Success depends on the device, its software vulnerabilities and the way it processes the content.
In the case described by Citizen Lab, the advertisement is not merely a banner that redirects a user to a fraudulent website. It can be part of a technical chain that uses signals from the advertising ecosystem to identify a device and attempt to deliver spyware.
That distinction matters. A conventional malicious advertisement often relies on a user taking a particular action, while a zero-click attack can potentially occur without it. The term does not mean that every device shown an advertisement is automatically infected. Exploitation may depend on vulnerabilities, device configuration and other technical conditions.
What did researchers find about Discover-Tech and Controlium?
According to the report, Discover-Tech presented itself as a conventional company in the digital advertising industry. Researchers linked it to a platform called Controlium, which allegedly allowed partners to profile and select devices for surveillance or attacks.
The platform used identifiers such as IP addresses, mobile advertising IDs and browser identifiers. These signals can help connect a device to a particular audience or recognize it within an advertising system.
Programmatic advertising often relies on automated, real-time auctions. In these transactions, different platforms exchange information to determine which advertisement should be displayed to a user. The systems are designed to match ads with audiences, but the information flowing through them can also create opportunities for tracking and profiling.
The investigation alleges that Discover-Tech’s infrastructure acted as a bridge between this advertising ecosystem and commercial spyware operators. Researchers also reported finding exposed portions of the platform’s infrastructure, including code and login records, that helped them reconstruct how the system operated.
These findings matter because they suggest that a platform used to manage advertising can also become a tool for selecting targets and delivering malicious content. They do not establish that every device receiving ads from this infrastructure was compromised.
At least 45 devices at Al Jazeera were affected
One of the most concrete parts of the investigation concerns Al Jazeera, the Qatar-based media organization.
Citizen Lab says that during 2024 and 2025, advertisements associated with Discover-Tech were used to deliver spyware linked to Candiru. Researchers reported identifying at least 45 devices at the organization that were believed to have been compromised.
The case is particularly significant for journalists, newsrooms and organizations handling sensitive information. Their devices may contain communications with sources, confidential documents, contact details and information that could expose other people to risk.
In a sophisticated spyware attack, compromising a device may create opportunities to collect more than browsing history. What an attacker can actually access depends on the spyware’s capabilities, the vulnerabilities exploited and the privileges obtained.
The report should not be interpreted as evidence that every device at Al Jazeera — or every ordinary internet user’s device — was affected. The figure of 45 devices is the minimum reported by researchers for the identified case.
Candiru and the commercial spyware industry
Citizen Lab linked the campaign to spyware developed by Candiru, an Israeli company known in the digital surveillance industry. The company has previously been subject to restrictions imposed by the U.S. government.
Commercial spyware is surveillance software developed and supplied to selected customers to collect information from targeted devices. Such products are often marketed for investigative or security purposes, but digital-rights organizations have documented cases in which spyware technologies have been used against journalists, activists, researchers and civil-society members.
A central challenge is the lack of transparency surrounding end users and the objectives of individual operations. Even when one company develops the technology and another provides the distribution infrastructure, determining who ordered an attack requires separate evidence.
In the investigation published on October 15, researchers did not conclusively identify the governments that may have been behind the attacks. It is therefore more accurate to say that the investigation documents infrastructure used to distribute spyware, without claiming that authorities in a particular country have been proven to have organized the operation.
Why the advertising industry matters
Digital advertising depends on a long chain of intermediaries: website publishers, apps, auction platforms, advertising networks, analytics companies and targeting-technology providers.
That complexity makes it difficult for users to understand which companies are involved in displaying a particular advertisement. Publishers face the challenge of protecting their audiences while maintaining the advertising revenue that supports free services.
According to the investigation, Discover-Tech had access to a broad advertising infrastructure. Auction records reviewed by researchers indicated that its advertisements appeared across tens of thousands of apps and websites. That does not mean all those websites were collaborators or that their users were infected. Exposure to an advertisement, device compromise and attribution of an attack are three distinct questions requiring separate evidence.
The case also shows why security checks cannot be limited to files users download or links they click. Advertising platforms need to scrutinize advertiser behavior, supply chains, targeting methods and signals that may indicate abuse of their systems.
What action have platforms taken?
According to reporting by The Verge and Reuters, Google and Comcast-owned advertising company Beeswax removed Discover-Tech from their platforms. IAB Europe, an organization representing the digital advertising industry, suspended the company from its list of approved vendors.
These steps show that the findings had consequences for the company’s access to parts of the advertising ecosystem. However, removal from a platform is not the same as a court judgment and does not independently prove every allegation in the report. Final responsibility depends on the evidence and any relevant proceedings.
Citizen Lab and Confiant have called for stronger security controls across the advertising industry. The aim is to prevent ordinary advertising infrastructure from becoming a delivery channel for sophisticated cyberattacks.
What can users do to protect themselves?
Ordinary users cannot control the entire advertising supply chain, but they can reduce some risks.
1. Keep operating systems and apps updated. Security updates fix vulnerabilities that sophisticated attacks may exploit. Updates do not guarantee complete protection, but they remain one of the most important defensive measures.
2. Limit advertising tracking. Use your phone’s privacy settings to limit or reset advertising identifiers where the operating system allows it. This may reduce certain ways of linking activity to a device, but it does not make the device anonymous.
3. Consider a reputable ad blocker. A trusted ad blocker can reduce exposure to some malicious advertisements. It is not a complete defense against every attack and should be obtained from a reputable source.
4. Avoid unfamiliar apps and browser extensions. Install software from trusted sources and review the permissions it requests. Although zero-click attacks do not necessarily require user action, good digital hygiene still matters.
5. Seek specialist help if you may be a high-risk target. Journalists, activists, employees of sensitive organizations and people who may be targeted for surveillance should follow guidance from security teams and specialist organizations. If there is a serious suspicion of compromise, changing a few settings is not enough to determine whether a device has been infected.
What remains unclear?
Although the report presents technical evidence that targeted advertising was used as a channel for spyware, several questions remain open.
Researchers did not conclusively identify which governments, if any, ordered the documented operations. Nor has every device that received ads associated with the infrastructure been proven to be infected. The campaign’s full scope and its impact beyond the confirmed cases require further evidence.
Discover-Tech and Candiru should not be treated as responsible for every allegation solely because their names appear in the report. A complete assessment must consider the technical findings, responses from the parties involved and any subsequent developments.
TheTechSpot Take
This case exposes a structural weakness in the modern internet: systems designed to distribute advertisements globally can also be exploited to identify and target devices. The issue is not simply one bad advertisement; it is the way data and identifiers move through a large network of companies and platforms.
For users, the most reasonable advice is to keep devices updated, limit tracking and use reputable privacy tools. For platforms and publishers, the responsibility is greater: security controls must cover the advertising supply chain, not just the content displayed on a screen.
Citizen Lab’s investigation does not prove that every user faces immediate danger, but it documents a method that deserves serious attention. In an internet where advertising is everywhere, ad security is not merely a marketing issue — it is part of digital security.
