Citizen Lab Exposes Israeli Spyware Infecting Phones Through Ordinary Ads

By douglasharrington // 2026-10-18

Mastodon

Parler

Gab

Copy

Israeli mercenary spyware reached potentially hundreds of millions of devices worldwide through ordinary online advertisements that required no user interaction to deliver their payload, according to research by the University of Toronto's Citizen Lab. ^[1] The findings published Thursday, Oct. 15, said the incident is likely to be the first confirmation of zero-click mercenary spyware delivered through targeted ads ^[2]. The ads, loaded with the Candiru spyware, were placed by Israeli firm Discover-Tech.

What The Citizen Lab Investigation Found

During a four-month period examined by researchers, Discover-Tech ads appeared on almost 200,000 unique websites and Android and iOS applications across dozens of countries. ^[1]The Citizen Lab said the advertising supply chain effectively functions as a mass-profiling and infection system capable of reaching enormous populations with no user action whatsoever.

Scope Extended to Sensitive Networks, Researchers Say

According to The Citizen Lab, Discover-Tech ad impressions were also found in North Atlantic Treaty Organization and United Nations networks, the European Parliament, the European Commission and more than a dozen national governments. Ads also appeared within media organizations in eight countries, including Australia, Mexico and across Europe. The pattern suggests that the advertising infrastructure used in the campaign reached deeply into government, military and journalistic environments where surveillance would be most valuable.

Platform Access and Prior Blacklisting

Candiru's rebrand to Integrity Labs followed a 2025 acquisition by the U.S. private equity firm Integrity Partners, which is not subject to U.S. sanctions. This corporate restructuring allowed the spyware operation to continue under a new identity while its prior entity remained on the blacklist. Following the findings by the two research groups, Google, IAB Europe, Beeswax and other platforms disconnected Discover-Tech's access to the digital advertising market. In November 2021, Candiru was also used to target Middle East Eye and other websites, according to the security firm ESET, in an attack that targeted links to the Middle East with a strong focus on Yemen and the surrounding conflict.

Researcher Comments and Context

"The way online advertising works today is a systemic security threat," Wolfie Cristl, a senior researcher at The Citizen Lab, told Reuters. The reports describe an advertising model in which commercial ad platforms can be repurposed for tracking, reconnaissance and the automated delivery of malicious exploits without any interaction from the user. The findings add to a growing pattern of documented abuses of commercial spyware. In September 2026, suspected spyware attacks targeted the phones of at least three Turkish ministers, with Apple sending notifications warning that the devices may have been compromised ^[3]. In December 2025, a joint investigation by media outlets in Greece, Israel and Switzerland revealed that Predator spyware from the Intellexa Consortium, led by a former senior Israeli intelligence official, continued to be used against targets in multiple countries despite U.S. sanctions ^[4]. These cases point to a broader ecosystem in which commercial spyware vendors operate across borders, adapt to sanctions and find new delivery channels.

Conclusion

The Citizen Lab's findings document a technique that turns the everyday act of viewing an advertisement into a potential attack surface. Because the delivery mechanism requires no click and no download, users have no practical way to know they have been targeted. The advertising industry's reliance on real-time bidding, cookie matching and third-party ad networks creates a system in which surveillance capabilities can be embedded into ordinary commercial infrastructure and distributed at massive scale. According to the research, the companies involved in this case have been disconnected from major advertising platforms. Whether that disconnection will hold, and whether other ad networks have been used in similar ways, remains an open question.

References

Israeli spyware targeted 'hundreds of millions' through zero-click ads, researchers find. https://www.middleeasteye.net/news/israeli-spyware-targeted-hundreds-millions-through-zero-click-ads-researchers-find
Targeted ads delivered 0-click exploits to install mercenary malware. https://arstechnica.com/security/2026/10/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware/
Suspected spyware attacks target Turkish ministers’ phones. https://www.middleeasteye.net/news/suspected-spyware-attacks-target-turkish-ministers-phones
‘Intellexa Leaks’ Reveal Wider Reach of Predator Spyware. https://www.antiwar.com/blog/2025/12/04/intellexa-leaks-reveal-wider-reach-of-predator-spyware/

Explainer Infographic