You didn't have to click a suspicious link. You didn't have to download an attachment. In the attacks researchers uncovered, an ordinary online ad could provide the opening for spyware to reach a device while someone browsed a website or used an app.
The company at the center of the investigation is Israel's Discover-Tech. Its ads appeared on 120,768 websites and in 75,373 mobile apps between March and June. Those figures measure advertising reach, not hacked websites or infected apps. Researchers separately confirmed spyware infections at Al Jazeera, where at least 45 devices were targeted in attacks during 2024 and 2025.
The ad was the way in
The University of Toronto's Citizen Lab published its investigation on October 15, alongside separate research by advertising security company Confiant. They traced links between Discover-Tech's advertising infrastructure and Candiru, the Israeli mercenary spyware vendor now branded Integrity Labs.
They call the technique AdFection. An attacker buys advertising space, gets an ad delivered to a selected person's screen and uses the ad's code to connect the device to further infrastructure. For a targeted device, that chain can lead to spyware installation without a click.
Most people who encountered the ads were not selected for that next step. The operation could still collect identifying information from their browsers, giving its operators a much wider surveillance footprint than the confirmed infections alone.
The distinction matters because the operation combined two activities: finding and profiling people at scale, then delivering spyware to selected targets. A seemingly ordinary advertisement could serve both purposes.
What happened at Al Jazeera?
The broadcaster provided network logs that let investigators reconstruct the sequence: contact with Discover-Tech infrastructure, connections to a Candiru server that checked the device, then communication with spyware command-and-control servers. Researchers also analyzed a malicious Windows file recovered from a compromised device.
In fresh reporting on October 16, Al Jazeera said its technology team first spotted unusual activity in 2024. The network condemned the targeting of its staff and called for accountability.
Cybersecurity analyst Eddy Willems explained the technical hurdle to Al Jazeera:
Executing code inside the browser does not automatically give an attacker full control over the computer.
He added:
To escape the browser's isolated environment - the 'sandbox' - the attacker may need a second vulnerability.
An ad supplies a delivery route. Vulnerabilities provide the way past the device's defenses.
A huge advertising footprint
The researchers examined almost 3.8 billion bids for advertising impressions across four months. Discover-Tech appeared to win nearly 442 million. Its ads reached news websites, weather services and mobile games, including outlets whose readers would have no reason to associate their visit with a spyware operation.
The investigation also found ad exposure on networks associated with governments, international institutions and media organizations. That finding establishes reach into sensitive environments; the confirmed Al Jazeera infections are the evidence of successful spyware deployment described here.
The people serving the page and the people buying the ad can be entirely different businesses. That separation lets an attacker reach a reader without first taking over the publisher's website.
Google cuts access
Several advertising companies have acted. Google removed Discover-Tech from its advertising platforms, while Beeswax removed it from its buying platform. Vungle paused access pending a review, and Eskimi blocked its accounts and domains. IAB Europe also suspended the company's vendor registration.
Google told Reuters it had worked with the investigators and removed Discover-Tech:
for systematically violating our policies.
Discover-Tech and Candiru did not respond to the researchers' requests for comment by their deadline. Reuters also reported unanswered approaches to Discover-Tech and its chief executive.
For readers, the unsettling part is straightforward: avoiding suspicious clicks would not have stopped these attacks. Updating devices and reducing unnecessary ad tracking remain sensible precautions, but the investigation puts responsibility on the companies selling access to people's screens, too. They were the route in.