Online ads weaponised to deliver ‘zero-click’ spyware, researchers say

Citizen Lab researchers say targeted ads were used to deliver zero-click spyware, meaning victims did not need to click. AdFection infected devices at Al Jazeera with Candiru spyware. Researchers traced the campaign to Israeli ad-tech company Discover-Tech, whose ads appeared on more than 120,000 websites and 75,000 apps. At least 45 Al Jazeera devices were targeted in 2024 and 2025. Google and advertising platforms removed or suspended the company. The findings highlight how ad systems can be repurposed for surveillance.