Technology
Citizen Lab links online advertising infrastructure to zero-click spyware attacks
Citizen Lab researchers say they found evidence of a spyware campaign that used online advertising infrastructure to target devices without requiring user interaction. The investigation links ads associated with Discover-Tech to infrastructure attributed to Candiru and documents attacks against 45 Al Jazeera devices. Researchers say related ad records reached tens of thousands of apps and websites, though not every impression was weaponized. Google, IAB Europe and Beeswax took action against Discover-Tech, while the companies linked to the campaign did not respond.
Editorial summary · Publisher article
What matters
- Citizen Lab documented zero-click attacks against 45 Al Jazeera devices during 2024 and 2025.
- Researchers found attacker-linked ad tags across more than 70,000 mobile apps and 120,000 websites.
- Google blocked Discover-Tech from its ad platforms and added Safe Browsing warnings.
- The campaign illustrates how real-time bidding can connect targeted advertising with mercenary spyware infrastructure.
Why the advertising system matters
Real-time bidding distributes ads through a fast, complex network that can expose information about devices, locations and browsing activity. Researchers argue that the same targeting and profiling capabilities can be repurposed to direct malicious content at specific people.
Context & caveats
- The researchers say the ads were not necessarily all weaponized.
- Discover-Tech, its chief executive and Integrity Partners did not respond to the report’s requests for comment.
Why this made the edition
The report presents detailed Citizen Lab findings, affected-device evidence, platform responses and technical context about a consequential spyware delivery pathway.
Source material