A new Citizen Lab report says targeted online ads were used to deliver zero-click mercenary spyware. It names Israeli firm Discover-Tech as the ad vendor. According to the report, Discover-Tech’s ad targeting was used to deliver Candiru spyware to devices at Al Jazeera.
The report, published October 15 as Report 195, states its central finding in a single line.
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.
Candiru has rebranded as Integrity Labs, according to Citizen Lab. The part that matters for ordinary phone users is how the targets were picked.
How Discover-Tech’s ad targeting worked
Citizen Lab describes Discover-Tech as an Israeli company that presents itself as a legitimate ad business. Its platform, Controlium, let customers choose exactly who would see an ad. According to the report, targets could be picked by:
- Mobile advertising ID on Android or iOS
- Browser cookie ID from the MyDSP or Beeswax ad platforms
- IP address
The advertising ID your phone shares with apps is the identifier the report says customers could use to single people out. Citizen Lab says the same ads also tried to uncover the phone numbers of mobile users who saw them.
The report also names a second ad-intelligence vendor, which Citizen Lab calls DARK CARTOGRAPHER. It says that firm is building databases that link mobile advertising IDs to phone numbers.
How far the ads reached
Citizen Lab reviewed Discover-Tech’s bids on the MyDSP platform from March through June 2026. About 76.7% of those bids were for ads inside mobile apps. The remaining 23.3% were for ads in web browsers.
Ads carrying the attackers’ script tags reached users of 75,373 Android and iOS apps, according to the report. They also appeared on 120,768 websites in mobile and desktop browsers. Citizen Lab’s researchers say they were served these ads on the CBC and Yahoo websites and in a Sudoku app on Android.
The confirmed infection was on Windows
The infection Citizen Lab documents was at Al Jazeera, and it was on Windows. The report says Al Jazeera isolated a Windows DLL file from one of its compromised devices. TechCrunch reports that at least 45 Windows computers at the outlet were apparently hacked in 2024 and 2025.
The ads did reach Android and iOS apps. Still, none of the sources we reviewed confirm that any phone was infected. TechCrunch also reports that Candiru and another company, Bindecy, used Discover-Tech’s platform. Per TechCrunch, Citizen Lab did not say which governments were behind the attacks.
How to limit ad tracking on your phone
The report’s advice centers on cutting the tracking that made this targeting possible. In summary, Citizen Lab suggests you:
- Block ads in your browser with a reputable ad-blocking extension.
- Switch browsers to one built to block trackers and data collection.
- Reset your advertising ID on a regular basis, switch off ad tracking and use in-app opt-outs.
- Filter ads across your network at the home router, or through a reputable VPN that blocks ads.
Bill Marczak of Citizen Lab gave TechCrunch similar advice for anyone who might be a target. He suggested turning off ad tracking and considering blocking ads altogether.
The report calls this a complex threat. People at higher risk because of who they are or what they do should seek expert help. For most readers, these steps reduce ad tracking in general rather than guarantee protection against a targeted attack.
For more on recent threats, see our coverage of P7 DarkSword iPhone spyware, Midnight Mimosa malware on cheap Android phones and Google Messages Enhanced Protection.
Sources: Citizen Lab, TechCrunch
