The Ad Can Deliver Spyware Without a Click

Citizen Lab researchers have released technical evidence of mercenary spyware delivered through online advertising, Wired reports. Researchers concluded that 45 devices belonging to Al Jazeera were targeted during 2024 and 2025. They identified targeted ads issued by the Israeli-founded marketing firm Discover-Tech and attributed the spyware to Israeli developer Candiru.

The delivery method matters. An attacker uses advertising to reach a selected device while its owner browses a website or uses an app. The reported zero-click attack requires no tap, download approval, or other mistake by the target. Citizen Lab found that infected devices contacted domains linked to Discover-Tech and then infrastructure associated with Candiru. That sequence supplies an investigative trail; the supplied reporting does not explain every technical step that enabled installation.

Citizen Lab senior researcher Bill Marczak says a victim might not even see an ad. The familiar instruction to avoid suspicious links therefore misses the mechanism. The advertising pipeline has acquired a payload its audience did not order. Training people to click more carefully cannot repair an attack that dispenses with clicking.

The evidence also has boundaries. Forty-five targeted devices does not mean 45 confirmed infections. The researchers describe infected devices, but the supplied account does not establish an infection count within that group. Nor does the campaign show that every targeted advertisement carries spyware or that everyone who encounters advertising faces the same likelihood of compromise. A demonstrated delivery method is not a population-wide infection estimate.

Responsibility requires a similarly careful map. Issuing an ad, distributing its content, and developing spyware are different acts. Citizen Lab’s attribution warrants scrutiny of Discover-Tech and Candiru. It does not, by itself, prove that every service carrying an implicated ad knew what the ad would deliver. Investigators need records of who submitted the material, which services accepted it, and where the delivery chain connected to the identified domains.

The documented domains provide concrete starting points for detection and interruption. Advertising services can examine whether their records contain those connections and determine which accounts or delivery routes were involved. Whether an intermediary could have recognized the attack before delivery requires evidence about its visibility and controls. Calling the ecosystem sprawling explains the investigation’s difficulty. It does not discharge the operators.

Discover-Tech can investigate the ads Citizen Lab attributes to it, preserve relevant records, and stop any implicated distribution it controls. Candiru can answer the spyware attribution. Advertising intermediaries that find the campaign in their systems can suspend implicated accounts and share findings with investigators. Those are decisions available to operators, not additional precautions to assign to Al Jazeera’s device owners.