Zero-Click Spyware Delivered Through Online Ads Raises Corporate Security Concerns
Cyber security researchers have uncovered a sophisticated surveillance technique that allows spyware to be delivered through online advertisements without requiring victims to click a link, download a file or knowingly interact with malicious content.
The findings, published by the University of Toronto's Citizen Lab on 15 October 2026, reveal how digital advertising infrastructure was allegedly exploited to identify individuals, track their devices and deliver targeted spyware.
The investigation raises concerns for businesses, senior executives and organisations handling confidential information, particularly where conventional cyber security measures may struggle to detect highly targeted attacks.
Researchers Uncover Spyware Delivered Through Digital Advertising
The investigation, titled Exposing AdFection, examined the activities of Discover-Tech, an Israeli company operating within the digital advertising industry.
According to Citizen Lab, Discover-Tech's advertising infrastructure was used to facilitate attacks involving spyware developed by Candiru, a commercial surveillance technology provider also known as Integrity Labs.
Researchers identified evidence linking the infrastructure to attacks against devices at the international news organisation Al Jazeera during 2024 and 2025.
At least 45 devices were targeted, with investigators documenting evidence of spyware infections associated with the advertising-based delivery mechanism.
The researchers also analysed approximately four billion advertising bidding records. Their findings indicated that Discover-Tech advertisements appeared across almost 200,000 websites and mobile applications during a four-month period.
While this demonstrates the scale of the advertising infrastructure involved, it does not mean every device exposed to those advertisements was infected.
The investigation represents an important development in understanding how commercially available advertising technology can be exploited for covert digital surveillance.
How Does Zero-Click Spyware Work?
Traditional cyber attacks frequently depend on an individual taking an action, such as opening a malicious attachment, clicking a fraudulent link or downloading compromised software.
Zero-click attacks differ because they can exploit technical vulnerabilities without requiring the targeted individual to interact with the malicious content.
In the technique identified by Citizen Lab, the delivery process involved online advertising systems that ordinarily determine which advertisements appear on websites and within applications.
When an advertisement was displayed, embedded code could communicate with external infrastructure to assess information about the device.
The researchers found that this process could be used to identify particular targets and deliver additional malicious code capable of exploiting vulnerabilities.
Potentially relevant information included:
- Device advertising identifiers.
- Internet Protocol (IP) addresses.
- Browser and device characteristics.
- Advertising-related tracking information.
- Other technical identifiers associated with online activity.
This information could help distinguish an intended target from the wider population of people viewing advertisements.
Unlike a conventional phishing attempt, the targeted individual might receive no suspicious email or warning that an attack had occurred.
Importantly, displaying an advertisement does not automatically compromise a device. Successful infection depends on the attacker's targeting, the exploit deployed and whether the device is vulnerable.
Why This Matters for Corporate Security
Although the confirmed infections examined by Citizen Lab involved a media organisation, the underlying techniques have implications for businesses operating in sensitive commercial environments.
Senior executives, legal professionals, financial advisers and employees handling confidential material may possess information that makes them attractive targets for sophisticated surveillance operations.
A compromised device could potentially expose commercially sensitive communications, business records or other confidential information, depending on the capabilities of the spyware and the access obtained.
For organisations involved in negotiations, litigation, acquisitions or commercially sensitive projects, unauthorised access to electronic communications could create significant financial and reputational risks.
The investigation also demonstrates how surveillance threats can extend beyond malicious websites and suspicious attachments.
Legitimate advertising infrastructure may provide an additional route through which sophisticated attackers attempt to reach targeted individuals.
This does not establish that businesses generally face an immediate threat from the particular campaign identified by Citizen Lab. However, it reinforces the importance of assessing digital surveillance risks according to an organisation's activities, exposure and threat profile.
The Challenge of Detecting Sophisticated Spyware
One of the principal challenges associated with targeted spyware is that an infection may not produce obvious warning signs.
Unlike some forms of ransomware, which visibly disrupt systems or encrypt files, surveillance software may be designed to operate discreetly while collecting information.
A targeted individual may continue using their device without recognising that suspicious activity has occurred.
Depending on the circumstances, an investigation into suspected compromise may examine:
- Unusual network connections.
- Suspicious processes or software components.
- Evidence of unauthorised system activity.
- Relevant application and operating-system records.
- Known indicators associated with malicious infrastructure.
- Unexplained changes to device behaviour or configuration.
However, the absence of obvious indicators does not necessarily establish that a device is secure.
Sophisticated spyware may leave limited evidence, and the information available for examination can vary considerably depending on the device, operating system and circumstances.
This is where specialist Digital Forensics and Investigation Services can become relevant.
Where there is a reasonable basis to suspect compromise, appropriately scoped forensic examination may help preserve and analyse available electronic evidence, identify suspicious activity and establish what can reliably be determined.
Not every infection can be identified retrospectively, and forensic findings should distinguish between confirmed compromise, suspicious indicators and matters that remain uncertain.
What Can Businesses Do to Reduce Their Exposure?
Although sophisticated zero-click attacks can be difficult to prevent entirely, organisations can take practical steps to reduce their exposure and improve their ability to respond.
Keep Devices and Applications Updated
Security updates can address vulnerabilities exploited by malicious software.
Organisations should maintain appropriate patch-management procedures covering operating systems, browsers, applications and corporate devices.
Review Advertising and Tracking Exposure
The Citizen Lab investigation highlights the potential misuse of identifiers collected through digital advertising systems.
Limiting unnecessary tracking, reviewing privacy settings and considering appropriate content-filtering measures may help reduce certain forms of exposure.
However, these measures should not be treated as guarantees against sophisticated spyware attacks.
Apply Risk-Based Security Measures
Individuals handling especially sensitive information may require additional protective measures.
These could include strengthened device-management policies, restricted application access and enhanced monitoring of relevant security events.
The appropriate controls should reflect the organisation's actual threat environment rather than assuming every employee faces the same risk.
Establish Clear Incident Response Procedures
Businesses should ensure employees understand how to report suspected device compromise and know who is responsible for coordinating a response.
Where an incident is suspected, taking advice before resetting, wiping or replacing a device may help preserve potentially relevant evidence.
Conflict International's Cyber Security and Incident Response Services support organisations in assessing suspected security incidents, examining available indicators and identifying appropriate next steps.
Digital Surveillance Requires a Broader Security Approach
The Citizen Lab investigation illustrates how digital surveillance techniques continue to develop alongside legitimate technologies.
Advertising platforms were designed to connect businesses with audiences, yet the research demonstrates how aspects of that infrastructure can be repurposed for intrusive surveillance.
For businesses, the wider lesson is that protecting confidential information requires consideration of both technical vulnerabilities and the individuals or activities that may attract targeted attention.
An effective response may involve technical security assessments, appropriate device controls, digital evidence preservation and consideration of wider organisational risks.
It is also important to distinguish between cyber-based compromise and physical surveillance threats.
Spyware delivered through online advertising requires a different investigative approach from the detection of concealed microphones, cameras or other physical surveillance equipment.
Recognising these distinctions helps organisations select the appropriate response rather than relying on a single security measure to address every potential threat.
Responding to Suspected Digital Surveillance
The discovery of zero-click spyware delivered through advertising infrastructure highlights the importance of understanding how sophisticated surveillance attacks operate.
While such attacks should not be confused with everyday cyber threats, their potential consequences can be significant where sensitive commercial information is involved.
Organisations concerned about suspected device compromise should prioritise preserving available evidence, assessing the potential exposure and establishing an appropriate investigative response.
Conflict International works with businesses, legal professionals and private clients requiring digital forensic investigation and cyber security support in the UK and internationally.
Where electronic evidence may be relevant to suspected surveillance, data theft or another security incident, our team can assess the circumstances and recommend a proportionate approach.
Contact Conflict International to discuss your requirements in confidence.