Security News

Researchers say malicious ads silently infected phones at Al Jazeera, no click required

The Register · 16 Oct 2026

Key Takeaway Keep phones, browsers and apps updated promptly, and consider ad blocking or reduced ad tracking on devices used by staff who handle sensitive work, since malicious ads can now reach devices without a single click.

Researchers at Citizen Lab say they have found the first publicly confirmed case of zero-click mercenary spyware delivered through targeted online ads. The technique, dubbed "AdFection", can be triggered simply by opening a website or app, with no suspicious link or download involved. Devices at Al Jazeera were among those infected.

Citizen Lab alleges Israeli adtech firm Discover-Tech is behind the operation and acts as a middleman between the advertising industry and spyware vendors. Its Controlium platform allegedly exploits real-time bidding, the system that decides which ads appear when a page loads. Advertisers receive details about a user's device and location during that process, and Discover-Tech allegedly used this data to pick out specific targets and serve them malicious ads. Citizen Lab traced attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware (the developer is now known as Integrity Labs) delivered through Discover-Tech ads.

The company did not need to break into the ad system. Google and IAB Europe had listed it as an approved vendor since 2020, apparently unaware of what Citizen Lab says it was doing. Researchers reviewed nearly four billion ad-bidding records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026. This summary is based on the opening of the source article, not the full report.

spyware malvertising zero-click Citizen Lab mobile security

Summarised by CISO AI from The Register, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.