Zero-Click Spyware Hidden in Online Ads Exposed by Citizen Lab

You don't have to click a thing. Researchers at Citizen Lab say a commercial ad network has been quietly turned into a delivery pipeline for government-grade spyware — one where simply being shown the wrong ad is enough to get a device infected.

An ad platform that doubles as a hacking tool

The report, published October 15, names an Israeli company called Discover-Tech as the bridge between ordinary online advertising and what's known as "mercenary spyware" — surveillance software built and sold commercially, usually to government clients, rather than malware written by lone criminals. The setup is deceptively simple. An ad served through Discover-Tech's platform carries no malicious code itself; it just quietly reports the viewing device's advertising ID and IP address back to a Discover-Tech server. That server then decides, target by target, whether to push attack code to that specific device. Citizen Lab says two known spyware vendors, Candiru and Bindecy, used this system to reach people without sending a single phishing link or malicious attachment — a technique known as a zero-click attack, because the target never has to open, download, or approve anything.

Al Jazeera, and a much wider blast radius

The clearest documented case involves the broadcaster Al Jazeera, where Citizen Lab found at least 45 Windows computers infected between 2024 and 2025 after staff were exposed to tainted ads while browsing normally. But the newsroom appears to be one data point in a far bigger picture. Citizen Lab says it found the same exposure pattern on networks tied to the United Nations, the European Commission, and more than a dozen national governments. Attribution is murky by design: researchers recovered the spyware itself from one infected machine but not the underlying exploit, so the very first step of the attack chain had to be reconstructed rather than observed directly. Citizen Lab hasn't pinned the attacks on any specific government client.

"It's global espionage that we've uncovered on a massive scale," said Citizen Lab director Ron Deibert, calling the ad-based delivery method "a recipe for disaster."

Why Indian organisations should be paying attention

This isn't a story that stays neatly overseas. India already has a well-documented history with mercenary spyware — the 2021 Pegasus Project reporting showed journalists, activists, and officials here had been targeted using NSO Group's tools delivered through phone numbers and messaging apps. What Citizen Lab just described is a different delivery mechanism entirely, and arguably a harder one to defend against: it rides on the same programmatic ad exchanges that serve ordinary banner ads to millions of Indian users every day, through the browsers, news sites, and apps that make up one of the world's largest mobile ad markets. We've covered this pattern before, when Meta had to pull malware-laced ads off Facebook and Instagram after Indian authorities flagged them — proof that weaponised ad inventory reaching Indian screens isn't a hypothetical. Add in that India's Digital Personal Data Protection (DPDP) Act was written mainly to govern how companies collect and handle personal data, not to audit the opaque chain of ad-exchange intermediaries that can silently fingerprint a device, and you get a regulatory gap that mercenary spyware vendors are well positioned to exploit.

Who's actually at risk follows a familiar pattern: journalists, diplomats, human rights researchers, and government staff are the people worth this kind of expensive, targeted effort — not the average phone user. But the infrastructure being abused here is consumer-grade ad tech, the same kind every Indian website and app plugs into for revenue, which is exactly why the story matters beyond the small number of direct targets.

What actually helps here

• Keep operating systems and browsers patched — zero-click exploits still need an underlying software flaw to abuse, patched or not
• High-risk users (journalists, NGO staff, government officials) should consider browser isolation or a separate, locked-down device for sensitive work
• Ad and script blockers reduce exposure to third-party ad code generally, even though they aren't a guaranteed defence against a determined, targeted attack
• Organisations should treat unexplained device slowdowns or unusual network traffic as worth investigating, not dismissing — these infections are built to be invisible

The uncomfortable part of this story is that "don't click suspicious links" has been the core advice for years, and it simply doesn't apply here. The weak point isn't user behaviour; it's a trust chain between ad exchanges, ad buyers, and spyware vendors that nobody is meaningfully auditing. Patching software is something any organisation can do this week. Fixing how ad networks vet who's allowed to buy targeted placements is a slower, messier problem — and until someone forces that change, this particular door stays open.