Al Jazeera devices hit by zero-click spyware hidden in online ads, Citizen Lab says

Researchers at the Citizen Lab, a digital security research group at the University of Toronto, said on Wednesday, October 15, 2026, that online advertisements were used to deliver "zero-click" spyware, which can infect a device without its owner clicking or tapping anything. In a report it calls AdFection, the group said ads placed by an Israeli advertising technology company, Discover-Tech, were linked to attacks on at least 45 devices associated with the broadcaster Al Jazeera in 2024 and 2025. Citizen Lab attributed those attacks, with high confidence, to spyware made by Candiru, an Israeli surveillance vendor. Google has since cut Discover-Tech off from its advertising platforms.

Most online safety advice tells people not to click strange links or open unknown attachments. Zero-click spyware breaks that rule, because the victim does nothing wrong. What makes this report new is the delivery route. Citizen Lab says the company used ordinary ad space, the banners and boxes that appear inside apps and on websites, as a way to reach and pick out targets. Researchers described it as the first public confirmation that targeted ads have been used this way.

The system works because of how digital advertising already operates. When an ad loads, the ad network learns details about the device, such as its type, its location and its advertising ID. That data lets advertisers show the right ad to the right person. The report says the same process let attackers identify the phones and computers they wanted and send attack code only to them. The DARK CARTOGRAPHER finding goes further: if advertising IDs can be tied to phone numbers, then the supposedly anonymous data that follows people around the web can be turned back into a real identity.

There are limits to what has been shown. The confirmed attacks involve the Al Jazeera devices. Some coverage has described large numbers of hacked phones, but the wider spread of ads is not the same as the same number of infections, and analysts have cautioned against reading it that way. Citizen Lab has asked regulators to investigate whether Discover-Tech and Candiru broke any laws.

Short-term: The main ad platforms have moved quickly to cut off Discover-Tech, which closes this particular route. Security teams at news organisations, governments and companies are likely to review which ad networks can reach their staff's devices.

Long-term: The report adds pressure on the advertising industry to check who is allowed to buy ad space and what code their ads may run. It also strengthens the case for laws on mercenary spyware and on the trade in advertising data that can identify people.

Who is affected: Journalists, activists and officials who are the usual targets of commercial spyware; ordinary phone users, whose ad data travels through the same systems; and the advertising and app industries, which now face questions about how their networks were used.

Questions and Answers